MiAddViewsForSection
NTSTATUS __stdcall MiAddViewsForSection(_SUBSECTION *StartSubsection, UINT64 LastPteOffset, UINT64 Flags){
_CONTROL_AREA *ControlArea;
unsigned int v4;
unsigned int v5;
_SUBSECTION *v7;
UINT8 CurrentIrql;
unsigned int v9;
NTSTATUS active;
__int32 bf_34;
UINT64 PtesInSubsection;
NTSTATUS result;
UINT64 v14;
_ETHREAD *v15;
unsigned __int8 v16;
int v17;
bool v18;
__int64 v19;
_KLOCK_ENTRY *v20;
unsigned int v21;
__int64 v22;
_EX_PUSH_LOCK *Segment;
_EX_PUSH_LOCK *v24;
__int64 SessionId;
_ETHREAD *v26;
VOID *v27;
int v28;
__int64 v29;
int v30;
_KLOCK_ENTRY *v31;
unsigned __int8 v32;
_ETHREAD *v33;
INT64 *p_ControlAreaLock;
unsigned int v35;
_EX_PUSH_LOCK *v36;
__int64 v37;
_ETHREAD *v38;
VOID *v39;
int v40;
__int64 v41;
_KLOCK_ENTRY *v42;
__int64 v43;
unsigned __int8 v44;
int *v45;
UINT64 v46;
UINT64 v47;
_EX_PUSH_LOCK *v48;
unsigned int v49;
int v50;
__int64 v51;
int v52;
_KLOCK_ENTRY *v53;
unsigned __int8 v54;
UINT8 v55;
UINT64 AllocationFlags;
unsigned int Flagsa;
_EX_PUSH_LOCK *Lock;
_EX_PUSH_LOCK *Locka;
_EX_PUSH_LOCK *Lockb;
NTSTATUS BugCheckParameter3;
int BugCheckParameter3_4;
_EX_PUSH_LOCK *v63;
_ETHREAD *CurrentThread;
int v65;
int v66;
unsigned int v67;
int v68;
UINT64 a3;
int v70;
int v71;
_SUBSECTION *LastSubsection;
_SUBSECTION *v73;
_ETHREAD *Thread;
int v75;
_KLOCK_ENTRY *v76;
INT64 *SpinLock;
__int64 v78;
int BugCheckParameter1;
_ETHREAD *BugCheckParameter1a;
unsigned __int8 AbAllocationRegionCount;
unsigned int v83;
unsigned __int8 v84;
unsigned __int8 v85;
unsigned __int8 v86;
unsigned int NumberOfPtes;
NTSTATUS NumberOfPtesa;
int NumberOfPtesb;
ControlArea = StartSubsection->ControlArea;
v4 = 0;
v5 = Flags;
Flagsa = Flags;
LastSubsection = 0i64;
v7 = StartSubsection;
if( ControlArea->FilePointer.Value )
{
BugCheckParameter1 = 1;
CurrentThread = 0i64;
v63 = 0i64;
}
else
{
Segment = (_EX_PUSH_LOCK *)ControlArea->Segment;
BugCheckParameter1 = 0;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
v63 = Segment;
ExAcquirePushLockExclusiveEx(Segment + 5, 0i64);
}
SpinLock = (INT64 *)&ControlArea->ControlAreaLock;
v71 = v5 & 0x180;
CurrentIrql = KeGetCurrentIrql();
__writecr8(2ui64);
ExpAcquireSpinLockExclusive((INT64 *)&ControlArea->ControlAreaLock, CurrentIrql);
if( (v5 & 1) != 0 )
{
++ControlArea->NumberOfMappedViews;
++ControlArea->u2.NumberOfSystemCacheViews;
v5 |= 4u;
v9 = v5;
Flagsa = v5;
}
else
{
v9 = v5;
}
BugCheckParameter3 = -1;
v78 = 0x7FFFFFFFFFFFFFFCi64;
while( 1 )
{
NumberOfPtes = v7->PtesInSubsection;
v73 = v7;
if( v7->SubsectionBase )
break;
v75 = v7->_bf_34 & 0x3FFFFFFF;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ControlArea->ControlAreaLock);
__writecr8(CurrentIrql);
if( !BugCheckParameter1 )
{
v24 = v63 + 5;
Lock = v63 + 5;
if( (_InterlockedExchangeAdd64(&v63[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
{
ExfTryToWakePushLock(v24);
v24 = Lock;
}
BugCheckParameter3_4 = 0;
Thread = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)v24) == 1 )
SessionId = (unsigned int)MmGetSessionIdEx(Thread->Tcb.ApcState.Process);
else
SessionId = 0xFFFFFFFFi64;
v26 = Thread;
--Thread->Tcb.SpecialApcDisable;
++v26->Tcb.AbAllocationRegionCount;
v27 = Lock;
AbAllocationRegionCount = v26->Tcb.AbAllocationRegionCount;
v28 = ((char)v26->Tcb.AbEntrySummary | (char)v26->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v18 = !_BitScanReverse((unsigned int *)&v29, v28);
v65 = v29;
if( v18 )
goto LABEL_73;
while( 1 )
{
v30 = ~(1 << v29);
v31 = &v26->Tcb.LockEntries[v29];
v28 &= v30;
v76 = v31;
if( (v31->AcquiredByte & 1) != 0
&& (v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v78 & v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0) == ((unsigned __int64)Lock & 0x7FFFFFFFFFFFFFFCi64)
&& v31->LockState.SessionId == (_DWORD)SessionId )
{
v31->AcquiredByte &= ~1u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v18 = !_BitScanReverse((unsigned int *)&v29, v28);
v65 = v29;
if( v18 )
goto LABEL_73;
}
if( !v31 )
{
LABEL_73:
if( (*(&v26->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v26, Lock, (PVOID)SessionId, 0i64);
}
else
{
v31->CrossThreadReleasableAndBusyByte |= 2u;
if( v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v31);
v31 = v76;
v26 = Thread;
v27 = Lock;
}
BugCheckParameter3_4 = 0;
BugCheckParameter3_4 = v31->BoostBitmap.AllFields & 0x1FFFF;
v31->BoostBitmap.AllFields &= 0xFFFE0000;
v31->ThreadLocalFlags &= ~1u;
v31->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v32 = 1 << (v31 - v26->Tcb.LockEntries);
if( AbAllocationRegionCount == 1 )
v26->Tcb.AbEntrySummary |= v32;
else
_InterlockedOr8((volatile signed __int8 *)&v26->Tcb.AbOrphanedEntrySummary, v32);
}
--v26->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v26->Tcb, v27, (UINT64 *)&BugCheckParameter3_4);
v33 = Thread;
v18 = Thread->Tcb.SpecialApcDisable++ == -1;
if( v18 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v33->Tcb.ApcState.ApcListHead[0].Flink != &v33->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}
if( (v5 & 2) != 0 )
return -1073741431;
MiCreatePrototypePtes(v7, Flagsa, NumberOfPtes - v75, NumberOfPtes);
NumberOfPtesa = result;
if( result < 0 )
{
if( result != -1073741302 )
goto LABEL_141;
if( !BugCheckParameter1 )
{
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockExclusiveEx(v63 + 5, 0i64);
}
ExAcquireSpinLockExclusive((INT64 *)&ControlArea->ControlAreaLock);
goto LABEL_48;
}
if( BugCheckParameter1 )
goto LABEL_41;
--CurrentThread->Tcb.SpecialApcDisable;
ExAcquirePushLockExclusiveEx(v63 + 5, 0i64);
ExAcquireSpinLockExclusive((INT64 *)&ControlArea->ControlAreaLock);
LABEL_11:
if( LastPteOffset )
{
PtesInSubsection = v7->PtesInSubsection;
if( LastPteOffset <= PtesInSubsection )
goto LABEL_13;
LastPteOffset -= PtesInSubsection;
}
v7 = v7->NextSubsection;
LastSubsection = v73;
if( !BugCheckParameter1 )
{
v9 = v71 | 4;
LastSubsection = v73;
Flagsa = v71 | 4;
goto LABEL_49;
}
LABEL_48:
v9 = Flagsa;
LABEL_49:
if( !v7 )
{
LABEL_13:
*(_DWORD *)SpinLock = 0;
__writecr8(CurrentIrql);
if( BugCheckParameter1 )
return 0;
v14 = (UINT64)&v63[5];
if( (_InterlockedExchangeAdd64(&v63[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
ExfTryToWakePushLock((_EX_PUSH_LOCK *)v14);
LODWORD(a3) = 0;
v15 = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType(v14) == 1 )
BugCheckParameter3 = MmGetSessionIdEx(v15->Tcb.ApcState.Process);
--v15->Tcb.SpecialApcDisable;
v16 = ++v15->Tcb.AbAllocationRegionCount;
v17 = ((char)v15->Tcb.AbEntrySummary | (char)v15->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v18 = !_BitScanReverse((unsigned int *)&v19, v17);
v68 = v19;
if( v18 )
{
LABEL_43:
v21 = BugCheckParameter3;
}
else
{
while( 1 )
{
v20 = &v15->Tcb.LockEntries[v19];
v17 &= ~(1 << v19);
if( (v20->AcquiredByte & 1) != 0
&& (v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v14 & 0x7FFFFFFFFFFFFFFCi64) )
{
v21 = BugCheckParameter3;
if( v20->LockState.SessionId == BugCheckParameter3 )
{
v20->AcquiredByte &= ~1u;
if( v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
}
v18 = !_BitScanReverse((unsigned int *)&v19, v17);
v68 = v19;
if( v18 )
goto LABEL_43;
}
if( v20 )
{
v20->CrossThreadReleasableAndBusyByte |= 2u;
if( v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
KiAbEntryRemoveFromTree(v20);
LODWORD(a3) = v20->BoostBitmap.AllFields & 0x1FFFF;
v20->BoostBitmap.AllFields &= 0xFFFE0000;
v20->ThreadLocalFlags &= ~1u;
v20->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v22 = v20 - v15->Tcb.LockEntries;
if( v16 == 1 )
v15->Tcb.AbEntrySummary |= 1 << v22;
else
_InterlockedOr8((volatile signed __int8 *)&v15->Tcb.AbOrphanedEntrySummary, 1 << v22);
LABEL_31:
--v15->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v15->Tcb, (VOID *)v14, &a3);
v18 = v15->Tcb.SpecialApcDisable++ == -1;
if( v18 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v15->Tcb.ApcState.ApcListHead[0].Flink != &v15->Tcb.152 )
KiCheckForKernelApcDelivery();
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
return 0;
}
}
if( (*(&v15->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, v15, (PVOID)v14, (PVOID)v21, 0i64);
goto LABEL_31;
}
}
if( (v5 & 0x400) == 0 )
{
active = MiReferenceActiveSubsection(v7, v9, CurrentIrql);
NumberOfPtesa = active;
if( active < 0 )
{
if( active != -1073741302 )
{
p_ControlAreaLock = (INT64 *)&ControlArea->ControlAreaLock;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ControlArea->ControlAreaLock);
__writecr8(CurrentIrql);
v35 = BugCheckParameter1;
if( !BugCheckParameter1 )
{
v36 = v63 + 5;
Locka = v63 + 5;
if( (_InterlockedExchangeAdd64(&v63[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
{
ExfTryToWakePushLock(v36);
v36 = Locka;
}
v67 = 0;
BugCheckParameter1a = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)v36) == 1 )
v37 = (unsigned int)MmGetSessionIdEx(BugCheckParameter1a->Tcb.ApcState.Process);
else
v37 = 0xFFFFFFFFi64;
v38 = BugCheckParameter1a;
--BugCheckParameter1a->Tcb.SpecialApcDisable;
++BugCheckParameter1a->Tcb.AbAllocationRegionCount;
v39 = Locka;
v84 = BugCheckParameter1a->Tcb.AbAllocationRegionCount;
v73 = (_SUBSECTION *)((unsigned __int64)Locka & 0x7FFFFFFFFFFFFFFCi64);
v40 = ((char)BugCheckParameter1a->Tcb.AbEntrySummary | (char)BugCheckParameter1a->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v18 = !_BitScanReverse((unsigned int *)&v41, v40);
v66 = v41;
if( v18 )
goto LABEL_106;
while( 1 )
{
v42 = &BugCheckParameter1a->Tcb.LockEntries[v41];
v76 = v42;
v40 &= ~(1 << v41);
if( (v42->AcquiredByte & 1) != 0
&& (v42->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (_SUBSECTION *)(v42->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == v73
&& v42->LockState.SessionId == (_DWORD)v37 )
{
v42->AcquiredByte &= ~1u;
if( v42->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v18 = !_BitScanReverse((unsigned int *)&v41, v40);
v66 = v41;
if( v18 )
goto LABEL_106;
}
if( !v42 )
{
LABEL_106:
if( (*(&BugCheckParameter1a->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, BugCheckParameter1a, Locka, (PVOID)v37, 0i64);
}
else
{
v42->CrossThreadReleasableAndBusyByte |= 2u;
if( v42->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v42);
v38 = BugCheckParameter1a;
v42 = v76;
v39 = Locka;
}
v67 = v42->BoostBitmap.AllFields & 0x1FFFF;
v42->BoostBitmap.AllFields &= 0xFFFE0000;
v42->ThreadLocalFlags &= ~1u;
v42->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v43 = (__int64)((unsigned __int128)(((char *)v42 - (char *)v38->Tcb.LockEntries)
* (__int128)0x2AAAAAAAAAAAAAABi64) >> 64) >> 4;
v44 = 1 << (v43 + (v43 < 0));
if( v84 == 1 )
v38->Tcb.AbEntrySummary |= v44;
else
_InterlockedOr8((volatile signed __int8 *)&v38->Tcb.AbOrphanedEntrySummary, v44);
}
v45 = (int *)&v67;
goto LABEL_111;
}
goto LABEL_115;
}
goto LABEL_48;
}
LastSubsection = v7;
if( BugCheckParameter1 != 1 )
goto LABEL_11;
bf_34 = v7->_bf_34;
if( (bf_34 & 0x40000000) == 0 )
goto LABEL_11;
v83 = v7->PtesInSubsection;
NumberOfPtesb = bf_34 & 0x3FFFFFFF;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ControlArea->ControlAreaLock);
__writecr8(CurrentIrql);
LODWORD(AllocationFlags) = 0;
result = MiAllocateFileExtents(v7, 0i64, v7->SubsectionBase, v83 - NumberOfPtesb, AllocationFlags);
NumberOfPtesa = result;
if( result < 0 )
{
LABEL_141:
v35 = BugCheckParameter1;
p_ControlAreaLock = (INT64 *)&ControlArea->ControlAreaLock;
goto LABEL_116;
}
LABEL_41:
ExAcquireSpinLockExclusive((INT64 *)&ControlArea->ControlAreaLock);
goto LABEL_11;
}
p_ControlAreaLock = (INT64 *)&ControlArea->ControlAreaLock;
NumberOfPtesa = -1073741800;
ExReleaseSpinLockExclusiveFromDpcLevel((INT64 *)&ControlArea->ControlAreaLock);
__writecr8(CurrentIrql);
v35 = BugCheckParameter1;
if( !BugCheckParameter1 )
{
v48 = v63 + 5;
Lockb = v63 + 5;
if( (_InterlockedExchangeAdd64(&v63[5]._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
{
ExfTryToWakePushLock(v48);
v48 = Lockb;
}
v70 = 0;
BugCheckParameter1a = (_ETHREAD *)KeGetCurrentThread();
if( MiGetSystemRegionType((UINT64)v48) == 1 )
v49 = MmGetSessionIdEx(BugCheckParameter1a->Tcb.ApcState.Process);
else
v49 = -1;
v38 = BugCheckParameter1a;
--BugCheckParameter1a->Tcb.SpecialApcDisable;
++BugCheckParameter1a->Tcb.AbAllocationRegionCount;
v39 = Lockb;
v86 = BugCheckParameter1a->Tcb.AbAllocationRegionCount;
v50 = ((char)BugCheckParameter1a->Tcb.AbEntrySummary | (char)BugCheckParameter1a->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
v18 = !_BitScanReverse((unsigned int *)&v51, v50);
HIDWORD(a3) = v51;
if( v18 )
goto LABEL_139;
while( 1 )
{
v52 = ~(1 << v51);
v53 = &BugCheckParameter1a->Tcb.LockEntries[v51];
v50 &= v52;
v73 = (_SUBSECTION *)v53;
if( (v53->AcquiredByte & 1) != 0
&& (v53->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
&& (v78 & v53->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0) == ((unsigned __int64)Lockb & 0x7FFFFFFFFFFFFFFCi64)
&& v53->LockState.SessionId == v49 )
{
v53->AcquiredByte &= ~1u;
if( v53->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
break;
}
v18 = !_BitScanReverse((unsigned int *)&v51, v50);
HIDWORD(a3) = v51;
if( v18 )
goto LABEL_139;
}
if( !v53 )
{
LABEL_139:
if( (*(&BugCheckParameter1a->Tcb.MiscFlags + 1) & 0x10000) == 0 )
KeBugCheckEx(0x162u, BugCheckParameter1a, Lockb, (PVOID)v49, 0i64);
}
else
{
v53->CrossThreadReleasableAndBusyByte |= 2u;
if( v53->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
{
KiAbEntryRemoveFromTree(v53);
v38 = BugCheckParameter1a;
v53 = (_KLOCK_ENTRY *)v73;
v39 = Lockb;
}
v70 = v53->BoostBitmap.AllFields & 0x1FFFF;
v53->BoostBitmap.AllFields &= 0xFFFE0000;
v53->ThreadLocalFlags &= ~1u;
v53->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
v54 = 1 << (v53 - v38->Tcb.LockEntries);
if( v86 == 1 )
v38->Tcb.AbEntrySummary |= v54;
else
_InterlockedOr8((volatile signed __int8 *)&v38->Tcb.AbOrphanedEntrySummary, v54);
}
v45 = &v70;
LABEL_111:
--v38->Tcb.AbAllocationRegionCount;
KiAbThreadRemoveBoosts(&v38->Tcb, v39, (UINT64 *)v45);
v18 = BugCheckParameter1a->Tcb.SpecialApcDisable++ == -1;
if( v18
&& ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)BugCheckParameter1a->Tcb.ApcState.ApcListHead[0].Flink != &BugCheckParameter1a->Tcb.152 )
{
KiCheckForKernelApcDelivery();
}
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
}
LABEL_115:
result = NumberOfPtesa;
LABEL_116:
if( LastSubsection )
{
v85 = ExAcquireSpinLockExclusive(p_ControlAreaLock);
if( (v5 & 5) == 0 )
v4 = v71 | 8;
LODWORD(v46) = MiDecrementSubsections(StartSubsection, LastSubsection, v4);
v47 = v46;
ExReleaseSpinLockExclusiveFromDpcLevel(p_ControlAreaLock);
__writecr8(v85);
if( v47 )
MiReturnCrossPartitionSectionCharges(
*(_MI_CROSS_PARTITION_CHARGES **)(*(&stru_140C4DB30 + 267) + 8i64 * (ControlArea->u1.Flags._bf_0 & 0x3FF)),
v35,
v47);
result = NumberOfPtesa;
}
if( (v5 & 1) != 0 )
{
v55 = ExAcquireSpinLockExclusive(p_ControlAreaLock);
--ControlArea->NumberOfMappedViews;
--ControlArea->u2.NumberOfSystemCacheViews;
MiCheckControlArea(ControlArea, v55);
return NumberOfPtesa;
}
return result;
}Referenced by:
MiCommitPagefileBackedSection
MiMapViewOfDataSection
MiPfPrepareReadList
MiPfPrepareSequentialReadList
MiReferenceDataSubsections
MmMapViewInSystemCache