path: root/private/ntos/mm/allocvm.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

   allocvm.c

Abstract:

    This module contains the routines which implement the
    NtAllocateVirtualMemory service.

Author:

    Lou Perazzoli (loup) 22-May-1989

Revision History:

--*/

#include "mi.h"

#if DBG
PEPROCESS MmWatchProcess;
VOID MmFooBar(VOID);
#endif // DBG

extern ULONG MmSharedCommit;

ULONG MMVADKEY = ' daV'; //Vad


#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,NtAllocateVirtualMemory)
#endif

NTSTATUS
MiResetVirtualMemory (
    IN PVOID StartingAddress,
    IN PVOID EndingAddress,
    IN PMMVAD Vad,
    IN PEPROCESS Process
    );


NTSTATUS
NtAllocateVirtualMemory(
    IN HANDLE ProcessHandle,
    IN OUT PVOID *BaseAddress,
    IN ULONG ZeroBits,
    IN OUT PULONG RegionSize,
    IN ULONG AllocationType,
    IN ULONG Protect
    )

/*++

Routine Description:

    This function creates a region of pages within the virtual address
    space of a subject process.

Arguments:

    ProcessHandle - Supplies an open handle to a process object.

    BaseAddress - Supplies a pointer to a variable that will receive
         the base address of the allocated region of pages.
         If the initial value of this argument is not null,
         then the region will be allocated starting at the
         specified virtual address rounded down to the next
         host page size address boundary. If the initial
         value of this argument is null, then the operating
         system will determine where to allocate the
         region.

    ZeroBits - Supplies the number of high order address bits that
         must be zero in the base address of the section
         view. The value of this argument must be less than
         21 and is only used when the operating system
         determines where to allocate the view (i.e. when
         BaseAddress is null).

    RegionSize - Supplies a pointer to a variable that will receive
         the actual size in bytes of the allocated region
         of pages. The initial value of this argument
         specifies the size in bytes of the region and is
         rounded up to the next host page size boundary.

    AllocationType - Supplies a set of flags that describe the type
         of allocation that is to be performed for the
         specified region of pages. Flags are:


         MEM_COMMIT - The specified region of pages is to
              be committed.

         MEM_RESERVE - The specified region of pages is to
              be reserved.

         MEM_TOP_DOWN - The specified region should be created at the
              highest virtual address possible based on ZeroBits.

         MEM_RESET - Reset the state of the specified region so
              that if the pages are in page paging file, they
              are discarded and pages of zeroes are brought in.
              If the pages are in memory and modified, they are marked
              as not modified so they will not be written out to
              the paging file.  The contents are NOT zeroed.

              The Protect argument is ignored, but a valid protection
              must be specified.

    Protect - Supplies the protection desired for the committed
         region of pages.

        Protect Values:


         PAGE_NOACCESS - No access to the committed region
              of pages is allowed. An attempt to read,
              write, or execute the committed region
              results in an access violation (i.e. a GP
              fault).

         PAGE_EXECUTE - Execute access to the committed
              region of pages is allowed. An attempt to
              read or write the committed region results in
              an access violation.

         PAGE_READONLY - Read only and execute access to the
              committed region of pages is allowed. An
              attempt to write the committed region results
              in an access violation.

         PAGE_READWRITE - Read, write, and execute access to
              the committed region of pages is allowed. If
              write access to the underlying section is
              allowed, then a single copy of the pages are
              shared. Otherwise the pages are shared read
              only/copy on write.

         PAGE_NOCACHE - The region of pages should be allocated
              as non-cachable.

Return Value:

    Returns the status

    TBS


--*/

{
    PMMVAD Vad;
    PMMVAD FoundVad;
    PEPROCESS Process;
    KPROCESSOR_MODE PreviousMode;
    PVOID StartingAddress;
    PVOID EndingAddress;
    NTSTATUS Status;
    PVOID TopAddress;
    PVOID CapturedBase;
    ULONG CapturedRegionSize;
    PMMPTE PointerPte;
    PMMPTE CommitLimitPte;
    ULONG ProtectionMask;
    PMMPTE LastPte;
    PMMPTE PointerPde;
    PMMPTE StartingPte;
    MMPTE TempPte;
    ULONG OldProtect;
    LONG QuotaCharge;
    ULONG QuotaFree;
    ULONG CopyOnWriteCharge;
    BOOLEAN PageFileChargeSucceeded;
    BOOLEAN Attached = FALSE;
    MMPTE DecommittedPte;
    ULONG ChangeProtection;

    PAGED_CODE();

    //
    // Check the zero bits argument for correctness.
    //

    if (ZeroBits > 21) {
        return STATUS_INVALID_PARAMETER_3;
    }

    //
    // Check the AllocationType for correctness.
    //

    if ((AllocationType & ~(MEM_COMMIT | MEM_RESERVE |
                            MEM_TOP_DOWN | MEM_RESET)) != 0) {
        return STATUS_INVALID_PARAMETER_5;
    }

    //
    // One of MEM_COMMIT, MEM_RESET or MEM_RESERVE must be set.
    //

    if ((AllocationType & (MEM_COMMIT | MEM_RESERVE | MEM_RESET)) == 0) {
        return STATUS_INVALID_PARAMETER_5;
    }

    if ((AllocationType & MEM_RESET) && (AllocationType != MEM_RESET)) {

        //
        // MEM_RESET may not be used with any other flag.
        //

        return STATUS_INVALID_PARAMETER_5;
    }

    //
    // Check the protection field.  This could raise an exception.
    //

    try {
        ProtectionMask = MiMakeProtectionMask (Protect);
    } except (EXCEPTION_EXECUTE_HANDLER) {
        return GetExceptionCode();
    }

    PreviousMode = KeGetPreviousMode();
    ChangeProtection = FALSE;

    //
    // Establish an exception handler, probe the specified addresses
    // for write access and capture the initial values.
    //

    try {

        if (PreviousMode != KernelMode) {

            ProbeForWriteUlong ((PULONG)BaseAddress);
            ProbeForWriteUlong (RegionSize);
        }

        //
        // Capture the base address.
        //

        CapturedBase = *BaseAddress;

        //
        // Capture the region size.
        //

        CapturedRegionSize = *RegionSize;

    } except (ExSystemExceptionFilter()) {

        //
        // If an exception occurs during the probe or capture
        // of the initial values, then handle the exception and
        // return the exception code as the status value.
        //

        return GetExceptionCode();
    }

#if DBG
    if (MmDebug & MM_DBG_SHOW_NT_CALLS) {
        if ( MmWatchProcess ) {
            ;
        } else {
            DbgPrint("allocvm process handle %lx base address %lx zero bits %lx\n",
                ProcessHandle, CapturedBase, ZeroBits);
            DbgPrint("    region size %lx alloc type %lx protect %lx\n",
                CapturedRegionSize, AllocationType, Protect);
        }
    }
#endif

    //
    // Make sure the specified starting and ending addresses are
    // within the user part of the virtual address space.
    //

    if (CapturedBase > MM_HIGHEST_VAD_ADDRESS) {

        //
        // Invalid base address.
        //

        return STATUS_INVALID_PARAMETER_2;
    }

    if ((((ULONG)MM_HIGHEST_VAD_ADDRESS + 1) - (ULONG)CapturedBase) <
            CapturedRegionSize) {

        //
        // Invalid region size;
        //

        return STATUS_INVALID_PARAMETER_4;
    }

    if (CapturedRegionSize == 0) {

        //
        // Region size cannot be 0.
        //

        return STATUS_INVALID_PARAMETER_4;
    }

    //
    // Reference the specified process handle for VM_OPERATION access.
    //

    if ( ProcessHandle == NtCurrentProcess() ) {
        Process = PsGetCurrentProcess();
    } else {
        Status = ObReferenceObjectByHandle ( ProcessHandle,
                                             PROCESS_VM_OPERATION,
                                             PsProcessType,
                                             PreviousMode,
                                             (PVOID *)&Process,
                                             NULL );

        if (!NT_SUCCESS(Status)) {
            return Status;
        }
    }

    //
    // If the specified process is not the current process, attach
    // to the specified process.
    //

    if (PsGetCurrentProcess() != Process) {
        KeAttachProcess (&Process->Pcb);
        Attached = TRUE;
    }

    //
    // Get the address creation mutex to block multiple threads from
    // creating or deleting address space at the same time and
    // get the working set mutex so virtual address descriptors can
    // be inserted and walked.  Block APCs so an APC which takes a page
    // fault does not corrupt various structures.
    //

    LOCK_WS_AND_ADDRESS_SPACE (Process);

    //
    // Make sure the address space was not deleted, if so, return an error.
    //

    if (Process->AddressSpaceDeleted != 0) {
        Status = STATUS_PROCESS_IS_TERMINATING;
        goto ErrorReturn;
    }

    if ((CapturedBase == NULL) || (AllocationType & MEM_RESERVE)) {

        //
        // PAGE_WRITECOPY is not valid for private pages.
        //

        if ((Protect & PAGE_WRITECOPY) ||
            (Protect & PAGE_EXECUTE_WRITECOPY)) {
            Status = STATUS_INVALID_PAGE_PROTECTION;
            goto ErrorReturn;
        }

        //
        // Reserve the address space.
        //

        if (CapturedBase == NULL) {

            //
            // No base address was specified.  This MUST be a reserve or
            // reserve and commit.
            //

            CapturedRegionSize = ROUND_TO_PAGES (CapturedRegionSize);

            //
            // If the zero bits is greater than 2, calculate the
            // proper starting value, for values of 0, 1, and 2, use
            // the highest address.
            //
            // NOTE THIS IS ONLY TRUE FOR MACHINES WITH 2GB USER VA.
            //

            if (ZeroBits >= 2) {
                TopAddress = (PVOID)((ULONG)0xFFFFFFFF >> ZeroBits);
            } else {
                TopAddress = (PVOID)MM_HIGHEST_VAD_ADDRESS;
            }

            //
            // Establish exception handler as MiFindEmptyAddressRange
            // will raise and exception if it fails.
            //

            try {

                if (AllocationType & MEM_TOP_DOWN) {

                    //
                    // Start from the top of memory downward.
                    //

                    StartingAddress = MiFindEmptyAddressRangeDown (
                                                  CapturedRegionSize,
                                                  TopAddress,
                                                  X64K);

                } else {

                    StartingAddress = MiFindEmptyAddressRange (
                                                    CapturedRegionSize,
                                                    X64K,
                                                    ZeroBits );
                }

            } except (EXCEPTION_EXECUTE_HANDLER) {
                Status = GetExceptionCode();
                goto ErrorReturn;
            }

            //
            // Calculate the ending address based on the top address.
            //

            EndingAddress = (PVOID)(((ULONG)StartingAddress +
                                  CapturedRegionSize - 1L) | (PAGE_SIZE - 1L));

            if (EndingAddress > TopAddress) {

                //
                // The allocation does not honor the zero bits argument.
                //

                Status = STATUS_NO_MEMORY;
                goto ErrorReturn;
            }

        } else {

            //
            // A non-NULL base address was specified. Check to make sure
            // the specified base address to ending address is currently
            // unused.
            //

            EndingAddress = (PVOID)(((ULONG)CapturedBase +
                                  CapturedRegionSize - 1L) | (PAGE_SIZE - 1L));

            //
            // Align the starting address on a 64k boundary.
            //

            StartingAddress = (PVOID)MI_64K_ALIGN(CapturedBase);

            //
            // See if a VAD overlaps with this starting/ending addres pair.
            //

            if (MiCheckForConflictingVad (StartingAddress, EndingAddress) !=
                    (PMMVAD)NULL) {

                Status = STATUS_CONFLICTING_ADDRESSES;
                goto ErrorReturn;
            }
        }

        //
        // Calculate the page file quota for this address range.
        //

        if (AllocationType & MEM_COMMIT) {
            QuotaCharge = (LONG)(BYTES_TO_PAGES ((ULONG)EndingAddress -
                       (ULONG)StartingAddress));
        } else {
            QuotaCharge = 0;
        }

        //
        // An unoccuppied address range has been found, build the virtual
        // address descriptor to describe this range.
        //

        //
        // Establish an exception handler and attempt to allocate
        // the pool and charge quota.  Note that the InsertVad routine
        // will also charge quota which could raise an exception.
        //

        try  {

            Vad = (PMMVAD)NULL;
            Vad = (PMMVAD)ExAllocatePoolWithTag (NonPagedPool,
                                                 sizeof(MMVAD_SHORT),
                                                 'SdaV');

            Vad->StartingVa = StartingAddress;
            Vad->EndingVa = EndingAddress;

            Vad->u.LongFlags = 0;
            if (AllocationType & MEM_COMMIT) {
                Vad->u.VadFlags.MemCommit = 1;
            }

            Vad->u.VadFlags.Protection = ProtectionMask;
            Vad->u.VadFlags.PrivateMemory = 1;

            Vad->u.VadFlags.CommitCharge = (ULONG)QuotaCharge;

            MiInsertVad (Vad);

        } except (EXCEPTION_EXECUTE_HANDLER) {

            if (Vad != (PMMVAD)NULL) {

                //
                // The pool allocation suceeded, but the quota charge
                // in InsertVad failed, deallocate the pool and return
                // and error.
                //

                ExFreePool (Vad);
                Status = GetExceptionCode();
            } else {
                Status = STATUS_INSUFFICIENT_RESOURCES;
            }
            goto ErrorReturn;
        }

        //
        // Unlock the working set lock, page faults can now be taken.
        //

        UNLOCK_WS (Process);

        //
        // Update the current virtual size in the process header, the
        // address space lock protects this operation.
        //

        CapturedRegionSize = (ULONG)EndingAddress - (ULONG)StartingAddress + 1L;
        Process->VirtualSize += CapturedRegionSize;

        if (Process->VirtualSize > Process->PeakVirtualSize) {
            Process->PeakVirtualSize = Process->VirtualSize;
        }

        //
        // Release the address space lock, lower IRQL, detach, and dereference
        // the process object.
        //

        UNLOCK_ADDRESS_SPACE(Process);
        if (Attached) {
            KeDetachProcess();
        }

        if ( ProcessHandle != NtCurrentProcess() ) {
            ObDereferenceObject (Process);
        }

        //
        // Establish an exception handler and write the size and base
        // address.
        //

        try {

            *RegionSize = CapturedRegionSize;
            *BaseAddress = StartingAddress;

        } except (EXCEPTION_EXECUTE_HANDLER) {

            //
            // Return success at this point even if the results
            // cannot be written.
            //

            NOTHING;
        }

#if DBG
        if (MmDebug & MM_DBG_SHOW_NT_CALLS) {
            if ( MmWatchProcess ) {
                if ( MmWatchProcess == PsGetCurrentProcess() ) {
                    DbgPrint("\n+++ ALLOC Type %lx Base %lx Size %lx\n",
                        AllocationType,StartingAddress, CapturedRegionSize);
                    MmFooBar();
                }
            } else {
                DbgPrint("return allocvm status %lx baseaddr %lx size %lx\n",
                    Status, StartingAddress, CapturedRegionSize);
            }
        }
#endif

#if DBG
        if (RtlAreLogging( RTL_EVENT_CLASS_VM )) {
            RtlLogEvent( MiAllocVmEventId,
                         RTL_EVENT_CLASS_VM,
                         StartingAddress,
                         CapturedRegionSize,
                         AllocationType,
                         Protect,
                         Protect
                       );

        }
#endif // DBG

        return STATUS_SUCCESS;

    } else {

        //
        // Commit previously reserved pages.  Note that these pages could
        // be either private or a section.
        //

        if (AllocationType == MEM_RESET) {

            //
            // Round up to page boundaries so good data is not reset.
            //

            EndingAddress = (PVOID)((ULONG)PAGE_ALIGN ((ULONG)CapturedBase +
                                    CapturedRegionSize) - 1);
            StartingAddress = (PVOID)PAGE_ALIGN((PUCHAR)CapturedBase + PAGE_SIZE - 1);
        } else {
            EndingAddress = (PVOID)(((ULONG)CapturedBase +
                                    CapturedRegionSize - 1) | (PAGE_SIZE - 1));
            StartingAddress = (PVOID)PAGE_ALIGN(CapturedBase);
        }

        CapturedRegionSize = (ULONG)EndingAddress - (ULONG)StartingAddress + 1;

        FoundVad = MiCheckForConflictingVad (StartingAddress, EndingAddress);

        if (FoundVad == (PMMVAD)NULL) {

            //
            // No virtual address is reserved at the specified base address,
            // return an error.
            //

            Status = STATUS_CONFLICTING_ADDRESSES;
            goto ErrorReturn;
        }

        //
        // Ensure that the starting and ending addresses are all within
        // the same virtual address descriptor.
        //

        if ((StartingAddress < FoundVad->StartingVa) ||
            (EndingAddress > FoundVad->EndingVa)) {

            //
            // Not withing the section virtual address descriptor,
            // return an error.
            //

            Status = STATUS_CONFLICTING_ADDRESSES;
            goto ErrorReturn;
        }

        if (AllocationType == MEM_RESET) {
            Status = MiResetVirtualMemory (StartingAddress,
                                           EndingAddress,
                                           FoundVad,
                                           Process);
            goto done;

        } else if (FoundVad->u.VadFlags.PrivateMemory == 0) {

            if (FoundVad->ControlArea->FilePointer != NULL) {

                //
                // Only page file backed sections can be committed.
                //

                Status = STATUS_ALREADY_COMMITTED;
                goto ErrorReturn;
            }

            //
            // The no cache option is not allowed for sections.
            //

            if (Protect & PAGE_NOCACHE) {
                Status = STATUS_INVALID_PAGE_PROTECTION;
                goto ErrorReturn;
            }

            if (FoundVad->u.VadFlags.NoChange == 1) {

                //
                // An attempt is made at changing the protection
                // of a SEC_NO_CHANGE section.
                //

                Status = MiCheckSecuredVad (FoundVad,
                                            CapturedBase,
                                            CapturedRegionSize,
                                            ProtectionMask);

                if (!NT_SUCCESS (Status)) {
                    goto ErrorReturn;
                }
            }

            StartingPte = MiGetProtoPteAddress (FoundVad, StartingAddress);
            PointerPte = StartingPte;
            LastPte = MiGetProtoPteAddress (FoundVad, EndingAddress);

            UNLOCK_WS (Process);

            ExAcquireFastMutex (&MmSectionCommitMutex);

#if 0
            if (AllocationType & MEM_CHECK_COMMIT_STATE) {

                //
                // Make sure none of the pages are already committed.
                //

                while (PointerPte <= LastPte) {

                    //
                    // Check to see if the prototype PTE is committed.
                    // Note that prototype PTEs cannot be decommited so
                    // PTE only needs checked for zeroes.
                    //
                    //

                    if (PointerPte->u.Long != 0) {
                        ExReleaseFastMutex (&MmSectionCommitMutex);
                        Status = STATUS_ALREADY_COMMITTED;
                        goto ErrorReturn1;
                    }
                    PointerPte += 1;
                }
            }
#endif //0

            PointerPte = StartingPte;


            //
            // Check to ensure these pages can be committed if this
            // is a page file backed segment.  Note that page file quota
            // has already been charged for this.
            //

            QuotaCharge = 1 + LastPte - StartingPte;

            CopyOnWriteCharge = 0;

            if (MI_IS_PTE_PROTECTION_COPY_WRITE(ProtectionMask)) {

                //
                // If the protection is copy on write, charge for
                // the copy on writes.
                //

                CopyOnWriteCharge = (ULONG)QuotaCharge;
            }

            //
            // Charge commitment for the range.  Establish an
            // exception handler as this could raise an exception.
            //

            QuotaFree = 0;
            Status = STATUS_SUCCESS;

            for (; ; ) {
                try {
                    PageFileChargeSucceeded = FALSE;
                    MiChargePageFileQuota ((ULONG)CopyOnWriteCharge, Process);

                    PageFileChargeSucceeded = TRUE;
                    MiChargeCommitment ((ULONG)QuotaCharge + CopyOnWriteCharge,
                                        NULL);
                    break;

                } except (EXCEPTION_EXECUTE_HANDLER) {

                    //
                    // An exception has occurred during the charging
                    // of commitment.  Release the held mutexes and return
                    // the exception status to the user.
                    //

                    if (PageFileChargeSucceeded) {
                        MiReturnPageFileQuota ((ULONG)CopyOnWriteCharge, Process);
                    }

                    if (Status != STATUS_SUCCESS) {

                        //
                        // We have already tried for the precise charge,
                        // return an error.
                        //

                        ExReleaseFastMutex (&MmSectionCommitMutex);
                        goto ErrorReturn1;
                    }

                    //
                    // Quota charge failed, calculate the exact quota
                    // taking into account pages that may already be
                    // committed and retry the operation.

                    while (PointerPte <= LastPte) {

                        //
                        // Check to see if the prototype PTE is committed.
                        // Note that prototype PTEs cannot be decommited so
                        // PTE only needs checked for zeroes.
                        //
                        //

                        if (PointerPte->u.Long != 0) {
                            QuotaFree -= 1;
                        }
                        PointerPte += 1;
                    }

                    PointerPte = StartingPte;

                    QuotaCharge += QuotaFree;
                    Status = GetExceptionCode();
                }
            }

            FoundVad->ControlArea->Segment->NumberOfCommittedPages +=
                                                        (ULONG)QuotaCharge;

            FoundVad->u.VadFlags.CommitCharge += CopyOnWriteCharge;
            Process->CommitCharge += CopyOnWriteCharge;
            MmSharedCommit += QuotaCharge;

            //
            // Commit all the pages.
            //

            TempPte = FoundVad->ControlArea->Segment->SegmentPteTemplate;
            while (PointerPte <= LastPte) {

                if (PointerPte->u.Long != 0) {

                    //
                    // Page is already committed, back out commitment.
                    //

                    QuotaFree += 1;
                } else {
                    *PointerPte = TempPte;
                }
                PointerPte += 1;
            }

            ExReleaseFastMutex (&MmSectionCommitMutex);

            if (QuotaFree != 0) {
                MiReturnCommitment (
                        (CopyOnWriteCharge ? 2*QuotaFree : QuotaFree));
                FoundVad->ControlArea->Segment->NumberOfCommittedPages -= QuotaFree;
                MmSharedCommit -= QuotaFree;
                ASSERT ((LONG)FoundVad->ControlArea->Segment->NumberOfCommittedPages >= 0);

                if (CopyOnWriteCharge != 0) {
                    FoundVad->u.VadFlags.CommitCharge -= QuotaFree;
                    Process->CommitCharge -= QuotaFree;
                    MiReturnPageFileQuota (
                                    QuotaFree,
                                    Process);
                }
                ASSERT ((LONG)FoundVad->u.VadFlags.CommitCharge >= 0);
            }

            //
            // Change all the protection to be protected as specified.
            //

            LOCK_WS (Process);

            MiSetProtectionOnSection (Process,
                                      FoundVad,
                                      StartingAddress,
                                      EndingAddress,
                                      Protect,
                                      &OldProtect,
                                      TRUE);

            UNLOCK_WS (Process);

            UNLOCK_ADDRESS_SPACE(Process);
            if (Attached) {
                KeDetachProcess();
            }
            if ( ProcessHandle != NtCurrentProcess() ) {
                ObDereferenceObject (Process);
            }

            *RegionSize = CapturedRegionSize;
            *BaseAddress = StartingAddress;

#if DBG
            if (MmDebug & MM_DBG_SHOW_NT_CALLS) {
                if ( MmWatchProcess ) {
                    if ( MmWatchProcess == PsGetCurrentProcess() ) {
                        DbgPrint("\n+++ ALLOC Type %lx Base %lx Size %lx\n",
                            AllocationType,StartingAddress, CapturedRegionSize);
                        MmFooBar();
                    }
                } else {
                    DbgPrint("return allocvm status %lx baseaddr %lx size %lx\n",
                        Status, CapturedRegionSize, StartingAddress);
                }
            }
#endif

#if DBG
            if (RtlAreLogging( RTL_EVENT_CLASS_VM )) {
                RtlLogEvent( MiAllocVmEventId,
                             RTL_EVENT_CLASS_VM,
                             StartingAddress,
                             CapturedRegionSize,
                             AllocationType,
                             Protect
                           );

            }
#endif // DBG

            return STATUS_SUCCESS;

        } else {

            //
            // PAGE_WRITECOPY is not valid for private pages.
            //

            if ((Protect & PAGE_WRITECOPY) ||
                (Protect & PAGE_EXECUTE_WRITECOPY)) {
                Status = STATUS_INVALID_PAGE_PROTECTION;
                goto ErrorReturn;
            }

            //
            // Ensure none of the pages are already committed as described
            // in the virtual address descriptor.
            //
#if 0
            if (AllocationType & MEM_CHECK_COMMIT_STATE) {
                if ( !MiIsEntireRangeDecommitted(StartingAddress,
                                                 EndingAddress,
                                                 FoundVad,
                                                 Process)) {

                    //
                    // Previously reserved pages have been committed, or
                    // an error occurred, release mutex and return status.
                    //

                    Status = STATUS_ALREADY_COMMITTED;
                    goto ErrorReturn;
                }
            }
#endif //0

            //
            // The address range has not been committed, commit it now.
            // Note, that for private pages, commitment is handled by
            // explicitly updating PTEs to contain Demand Zero entries.
            //

            PointerPde = MiGetPdeAddress (StartingAddress);
            PointerPte = MiGetPteAddress (StartingAddress);
            LastPte = MiGetPteAddress (EndingAddress);

            //
            // Check to ensure these pages can be committed.
            //

            QuotaCharge = 1 + LastPte - PointerPte;

            //
            // Charge quota and commitment for the range.  Establish an
            // exception handler as this could raise an exception.
            //

            QuotaFree = 0;
            Status = STATUS_SUCCESS;

            for (; ; ) {
                try {
                    PageFileChargeSucceeded = FALSE;

                    MiChargeCommitment ((ULONG)QuotaCharge, Process);
                    PageFileChargeSucceeded = TRUE;
                    MiChargePageFileQuota ((ULONG)QuotaCharge, Process);

                    FoundVad->u.VadFlags.CommitCharge += (ULONG)QuotaCharge;
                    Process->CommitCharge += QuotaCharge;
                    break;

                } except (EXCEPTION_EXECUTE_HANDLER) {

                    //
                    // An exception has occurred during the charging
                    // of commitment.  Release the held mutexes and return
                    // the exception status to the user.
                    //

                    if (PageFileChargeSucceeded) {
                        MiReturnCommitment ((ULONG)QuotaCharge);
                    }

                    if (Status != STATUS_SUCCESS) {

                        //
                        // We have already tried for the precise charge,
                        // return an error.
                        //

                        goto ErrorReturn;
                    }

                    Status = GetExceptionCode();

                    //
                    // Quota charge failed, calculate the exact quota
                    // taking into account pages that may already be
                    // committed and retry the operation.

                    QuotaFree = -(LONG)MiCalculatePageCommitment (
                                                        StartingAddress,
                                                        EndingAddress,
                                                        FoundVad,
                                                        Process);

                    QuotaCharge += QuotaFree;
                    ASSERT (QuotaCharge >= 0);
                }
            }


            //
            // Build a demand zero PTE with the proper protection.
            //

            TempPte = ZeroPte;
            TempPte.u.Soft.Protection = ProtectionMask;

            DecommittedPte = ZeroPte;
            DecommittedPte.u.Soft.Protection = MM_DECOMMIT;

            //
            // Fill in all the page table pages with the demand zero PTE.
            //

            MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE);

            if (FoundVad->u.VadFlags.MemCommit) {
                CommitLimitPte = MiGetPteAddress (FoundVad->EndingVa);
            } else {
                CommitLimitPte = NULL;
            }

            while (PointerPte <= LastPte) {

                if (((ULONG)PointerPte & (PAGE_SIZE - 1)) == 0) {

                    //
                    // Pointing to the next page table page, make
                    // a page table page exist and make it valid.
                    //

                    PointerPde = MiGetPteAddress (PointerPte);
                    MiMakePdeExistAndMakeValid(PointerPde, Process, FALSE);
                }

                if (PointerPte->u.Long == 0) {

                    if (PointerPte <= CommitLimitPte) {

                        //
                        // This page is implicitly committed.
                        //

                        QuotaFree += 1;

                    }

                    *PointerPte = TempPte;

                    //
                    // Increment the count of non-zero page table entires
                    // for this page table and the number of private pages
                    // for the process.
                    //

                    MmWorkingSetList->UsedPageTableEntries
                                        [MiGetPteOffset(PointerPte)] += 1;
                } else {
                    if (PointerPte->u.Long == DecommittedPte.u.Long) {

                        //
                        // Only commit the page if it is already decommitted.
                        //

                        *PointerPte = TempPte;
                    } else {
                        QuotaFree += 1;

                        //
                        // Make sure the protection for the page is
                        // right.
                        //

                        if (!ChangeProtection &&
                            (Protect != MiGetPageProtection (PointerPte,
                                                            Process))) {
                            ChangeProtection = TRUE;
                        }
                    }
                }
                PointerPte += 1;
            }
        }

        if (QuotaFree != 0) {
            ASSERT (QuotaFree >= 0);
            MiReturnCommitment (QuotaFree);
            MiReturnPageFileQuota (QuotaFree, Process);
            FoundVad->u.VadFlags.CommitCharge -= QuotaFree;
            Process->CommitCharge -= QuotaFree;
            ASSERT ((LONG)FoundVad->u.VadFlags.CommitCharge >= 0);
        }

        //
        // Previously reserved pages have been committed, or an error occurred,
        // release working set lock, address creation lock, detach,
        // dererence process and return status.
        //

done:
        UNLOCK_WS (Process);
        UNLOCK_ADDRESS_SPACE(Process);

        if (ChangeProtection) {
            PVOID Start;
            ULONG Size;
            Start = StartingAddress;
            Size = CapturedRegionSize;
            MiProtectVirtualMemory (Process,
                                    &Start,
                                    &Size,
                                    Protect,
                                    &Size);
        }

        if (Attached) {
            KeDetachProcess();
        }
        if ( ProcessHandle != NtCurrentProcess() ) {
            ObDereferenceObject (Process);
        }

        //
        // Establish an exception handler and write the size and base
        // address.
        //

        try {

            *RegionSize = CapturedRegionSize;
            *BaseAddress = StartingAddress;

        } except (EXCEPTION_EXECUTE_HANDLER) {
            return GetExceptionCode();
        }

#if DBG
        if (MmDebug & MM_DBG_SHOW_NT_CALLS) {
            if ( MmWatchProcess ) {
                if ( MmWatchProcess == PsGetCurrentProcess() ) {
                    DbgPrint("\n+++ ALLOC Type %lx Base %lx Size %lx\n",
                        AllocationType,StartingAddress, CapturedRegionSize);
                    MmFooBar();
                }
            } else {
                DbgPrint("return allocvm status %lx baseaddr %lx size %lx\n",
                    Status, CapturedRegionSize, StartingAddress);
            }
        }
#endif
#if DBG
        if (RtlAreLogging( RTL_EVENT_CLASS_VM )) {
            RtlLogEvent( MiAllocVmEventId,
                         RTL_EVENT_CLASS_VM,
                         StartingAddress,
                         CapturedRegionSize,
                         AllocationType,
                         Protect
                       );

        }
#endif // DBG

        return STATUS_SUCCESS;
    }

ErrorReturn:
        UNLOCK_WS (Process);

ErrorReturn1:

        UNLOCK_ADDRESS_SPACE (Process);
        if (Attached) {
            KeDetachProcess();
        }
        if ( ProcessHandle != NtCurrentProcess() ) {
            ObDereferenceObject (Process);
        }
        return Status;
}

NTSTATUS
MiResetVirtualMemory (
    IN PVOID StartingAddress,
    IN PVOID EndingAddress,
    IN PMMVAD Vad,
    IN PEPROCESS Process
    )

/*++

Routine Description:


Arguments:

    StartingAddress - Supplies the starting address of the range.

    RegionsSize - Supplies the size.

    Process - Supplies the current process.

Return Value:

Environment:

    Kernel mode, APCs disabled, WorkingSetMutex and AddressCreation mutexes
    held.

--*/

{
    PMMPTE PointerPte;
    PMMPTE ProtoPte;
    PMMPTE PointerPde;
    PMMPTE LastPte;
    MMPTE PteContents;
    ULONG PfnHeld = FALSE;
    ULONG First;
    KIRQL OldIrql;
    PMMPFN Pfn1;

    if (Vad->u.VadFlags.PrivateMemory == 0) {

        if (Vad->ControlArea->FilePointer != NULL) {

            //
            // Only page file backed sections can be committed.
            //

            return STATUS_USER_MAPPED_FILE;
        }
    }

    First = TRUE;
    PointerPte = MiGetPteAddress (StartingAddress);
    LastPte = MiGetPteAddress (EndingAddress);

    //
    // Examine all the PTEs in the range.
    //

    while (PointerPte <= LastPte) {

        if ((((ULONG)PointerPte & (PAGE_SIZE - 1)) == 0) ||
            (First)) {

            //
            // Pointing to the next page table page, make
            // a page table page exist and make it valid.
            //

            First = FALSE;
            PointerPde = MiGetPteAddress (PointerPte);
            if (!MiDoesPdeExistAndMakeValid(PointerPde,
                                            Process,
                                            (BOOLEAN)PfnHeld)) {

                //
                // This page directory entry is empty, go to the next one.
                //

                PointerPde += 1;
                PointerPte = MiGetVirtualAddressMappedByPte (PointerPde);
                continue;
            }
        }

        PteContents = *PointerPte;
        ProtoPte = NULL;

        if ((PteContents.u.Hard.Valid == 0) &&
            (PteContents.u.Soft.Prototype == 1))  {

            //
            // This is a prototype PTE, evaluate the
            // prototype PTE.
            //

            ProtoPte = MiGetProtoPteAddress(Vad,
                                            MiGetVirtualAddressMappedByPte(PointerPte));
            if (!PfnHeld) {
                PfnHeld = TRUE;
                LOCK_PFN (OldIrql);
            }
            MiMakeSystemAddressValidPfnWs (ProtoPte, Process);
            PteContents = *ProtoPte;
        }
        if (PteContents.u.Hard.Valid == 1) {
            if (!PfnHeld) {
                LOCK_PFN (OldIrql);
                PfnHeld = TRUE;
                continue;
            }

            Pfn1 = MI_PFN_ELEMENT (PteContents.u.Hard.PageFrameNumber);
            if (Pfn1->u3.e2.ReferenceCount == 1) {

                //
                // Only this process has the page mapped.
                //

                Pfn1->u3.e1.Modified = 0;
                MiReleasePageFileSpace (Pfn1->OriginalPte);
                Pfn1->OriginalPte.u.Soft.PageFileHigh = 0;
            }

            if ((!ProtoPte) && (MI_IS_PTE_DIRTY (PteContents))) {

                //
                // Clear the dirty bit and flush tb if it is NOT a prototype
                // PTE.
                //

                MI_SET_PTE_CLEAN (PteContents);
                KeFlushSingleTb (MiGetVirtualAddressMappedByPte (PointerPte),
                                 TRUE,
                                 FALSE,
                                 (PHARDWARE_PTE)PointerPte,
                                 PteContents.u.Flush);
            }

        } else if (PteContents.u.Soft.Transition == 1) {
            if (!PfnHeld) {
                LOCK_PFN (OldIrql);
                PfnHeld = TRUE;
                continue;
            }
            Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);
            if ((Pfn1->u3.e1.PageLocation == ModifiedPageList) &&
                (Pfn1->u3.e2.ReferenceCount == 0)) {

                //
                // Remove from the modified list, release the page
                // file space and insert on the standby list.
                //

                Pfn1->u3.e1.Modified = 0;
                MiUnlinkPageFromList (Pfn1);
                MiReleasePageFileSpace (Pfn1->OriginalPte);
                Pfn1->OriginalPte.u.Soft.PageFileHigh = 0;
                MiInsertPageInList (MmPageLocationList[StandbyPageList],
                                    PteContents.u.Trans.PageFrameNumber);
            }
        } else {
            if (PteContents.u.Soft.PageFileHigh != 0) {
                if (!PfnHeld) {
                    LOCK_PFN (OldIrql);
                }
                PfnHeld = FALSE;
                MiReleasePageFileSpace (PteContents);
                UNLOCK_PFN (OldIrql);
                if (ProtoPte) {
                    ProtoPte->u.Soft.PageFileHigh = 0;
                } else {
                    PointerPte->u.Soft.PageFileHigh = 0;
                }
            } else {
                if (PfnHeld) {
                    UNLOCK_PFN (OldIrql);
                }
                PfnHeld = FALSE;
            }
        }
        PointerPte += 1;
    }
    if (PfnHeld) {
        UNLOCK_PFN (OldIrql);
    }
    return STATUS_SUCCESS;
}


//
// Commented out, no longer used.
//
#if 0
BOOLEAN
MiIsEntireRangeDecommitted (
    IN PVOID StartingAddress,
    IN PVOID EndingAddress,
    IN PMMVAD Vad,
    IN PEPROCESS Process
    )

/*++

Routine Description:

    This routine examines the range of pages from the starting address
    up to and including the ending address and returns TRUE if every
    page in the range is either not committed or decommitted, FALSE otherwise.

Arguments:

    StartingAddress - Supplies the starting address of the range.

    EndingAddress - Supplies the ending address of the range.

    Vad - Supplies the virtual address descriptor which describes the range.

    Process - Supplies the current process.

Return Value:

    TRUE if the entire range is either decommitted or not committed.
    FALSE if any page within the range is committed.

Environment:

    Kernel mode, APCs disable, WorkingSetMutex and AddressCreation mutexes
    held.

--*/

{
    PMMPTE PointerPte;
    PMMPTE LastPte;
    PMMPTE PointerPde;
    ULONG FirstTime = TRUE;
    PVOID Va;

    PointerPde = MiGetPdeAddress (StartingAddress);
    PointerPte = MiGetPteAddress (StartingAddress);
    LastPte = MiGetPteAddress (EndingAddress);

    //
    // Set the Va to the starting address + 8, this solves problems
    // associated with address 0 (NULL) being used as a valid virtual
    // address and NULL in the VAD commitment field indicating no pages
    // are committed.
    //

    Va = (PVOID)((PCHAR)StartingAddress + 8);

    //
    // A page table page exists, examine the individual PTEs to ensure
    // none are in the committed state.
    //

    while (PointerPte <= LastPte) {

        //
        // Check to see if a page table page (PDE) exists if the PointerPte
        // address is on a page boundary or this is the first time through
        // the loop.
        //

        if ((((ULONG)PointerPte & (PAGE_SIZE - 1)) == 0) ||
            (FirstTime)) {

            //
            // This is a PDE boundary, check to see if the entire
            // PDE page exists.
            //

            FirstTime = FALSE;
            PointerPde = MiGetPteAddress (PointerPte);

            while (!MiDoesPdeExistAndMakeValid(PointerPde, Process, FALSE)) {

                //
                // No PDE exists for the starting address, check the VAD
                // to see whether the pages are committed or not.
                //

                PointerPde += 1;
                PointerPte = MiGetVirtualAddressMappedByPte (PointerPde);

                if (PointerPte > LastPte) {

                    //
                    // No page table page exists, if explict commitment
                    // via VAD indicates PTEs of zero should be committed,
                    // return an error.
                    //

                    if (EndingAddress <= Vad->CommittedAddress) {

                        //
                        // The entire range is committed, return an errror.
                        //

                        return FALSE;
                    } else {

                        //
                        // All pages are decommitted, return TRUE.
                        //

                        return TRUE;
                    }
                }

                Va = MiGetVirtualAddressMappedByPte (PointerPte);

                //
                // Make sure the range thus far is not committed.
                //

                if (Va <= Vad->CommittedAddress) {

                    //
                    // This range is committed, return an errror.
                    //

                    return FALSE;
                }
            }
        }

        //
        // The page table page exists, check each PTE for commitment.
        //

        if (PointerPte->u.Long == 0) {

            //
            // This PTE for the page is zero, check the VAD.
            //

            if (Va <= Vad->CommittedAddress) {

                //
                // The entire range is committed, return an errror.
                //

                return FALSE;
            }
        } else {

            //
            // Has this page been explicitly decommited?
            //

            if (!MiIsPteDecommittedPage (PointerPte)) {

                //
                // This page is committed, return an error.
                //

                return FALSE;
            }
        }
        PointerPte += 1;
        Va = (PVOID)((PCHAR)(Va) + PAGE_SIZE);
    }
    return TRUE;
}
#endif //0

#if DBG
VOID
MmFooBar(VOID){}
#endif