/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

   mmfault.c

Abstract:

    This module contains the handlers for access check, page faults
    and write faults.

Author:

    Lou Perazzoli (loup) 6-Apr-1989

Revision History:

--*/

#include "mi.h"

#define PROCESS_FOREGROUND_PRIORITY (9)

ULONG MmDelayPageFaults;

#if DBG
ULONG MmProtoPteVadLookups = 0;
ULONG MmProtoPteDirect = 0;
ULONG MmAutoEvaluate = 0;
#endif //DBG

#if DBG
PMMPTE MmPteHit = NULL;
#endif

#if DBG
ULONG MmLargePageFaultError;
#endif

#if DBG
extern ULONG MmPagingFileDebug[8192];
#endif


NTSTATUS
MmAccessFault (
    IN BOOLEAN StoreInstruction,
    IN PVOID VirtualAddress,
    IN KPROCESSOR_MODE PreviousMode
    )

/*++

Routine Description:

    This function is called by the kernel on data or instruction
    access faults.  The access fault was detected due to either
    an access violation, a PTE with the present bit clear, or a
    valid PTE with the dirty bit clear and a write operation.

    Also note that the access violation and the page fault could
    occur because of the Page Directory Entry contents as well.

    This routine determines what type of fault it is and calls
    the appropriate routine to handle the page fault or the write
    fault.

Arguments:

    StoreInstruction - Supplies TRUE (1) if the operation causes a write into
                     memory.  Note this value must be 1 or 0.

    VirtualAddress - Supplies the virtual address which caused the
                      fault.

    PreviousMode - Supplies the mode (kernel or user) in which the fault
                   occurred.

Return Value:

    Returns the status of the fault handling operation.  Can be one of:
        - Success.
        - Access Violation.
        - Guard Page Violation.
        - In-page Error.

Environment:

    Kernel mode, APC's disabled.

--*/

{
    PMMPTE PointerPde;
    PMMPTE PointerPte;
    PMMPTE PointerProtoPte = NULL;
    ULONG ProtectionCode;
    MMPTE TempPte;
    PEPROCESS CurrentProcess;
    KIRQL PreviousIrql;
    NTSTATUS status;
    ULONG ProtectCode;
    ULONG PageFrameIndex;
    ULONG WorkingSetIndex;
    KIRQL OldIrql;
    PMMPFN Pfn1;


    //
    // Block APC's and acquire the working set mutex.  This prevents any
    // changes to the address space and it prevents valid PTEs from becoming
    // invalid.
    //

    CurrentProcess = PsGetCurrentProcess ();

#if DBG
    if (MmDebug & MM_DBG_SHOW_FAULTS) {

        PETHREAD CurThread;

        CurThread = PsGetCurrentThread();
        DbgPrint("MM:**access fault - va %lx process %lx thread %lx\n",
                VirtualAddress, CurrentProcess, CurThread);
    }
#endif //DBG

    PreviousIrql = KeGetCurrentIrql ();

    //
    // Get the pointer to the PDE and the PTE for this page.
    //

    PointerPte = MiGetPteAddress (VirtualAddress);
    PointerPde = MiGetPdeAddress (VirtualAddress);

#if DBG
    if (PointerPte == MmPteHit) {
        DbgPrint("MM:pte hit at %lx\n",MmPteHit);
        DbgBreakPoint();
    }
#endif

    if ( PreviousIrql > APC_LEVEL ) {

        //
        // The PFN datbase lock is an executive spin-lock.  The pager could
        // get dirty faults or lock faults while servicing it owns the
        // PFN database lock.
        //

        MiCheckPdeForPagedPool (VirtualAddress);

#ifdef _X86_
        if (PointerPde->u.Hard.Valid == 1) {
            if (PointerPde->u.Hard.LargePage == 1) {
#if DBG
                if (MmLargePageFaultError < 10) {
                    DbgPrint ("MM - fault on Large page %lx\n",VirtualAddress);
                }
                MmLargePageFaultError += 1;
#endif //DBG
                return STATUS_SUCCESS;
            }
        }
#endif //X86

        if ((PointerPde->u.Hard.Valid == 0) || (PointerPte->u.Hard.Valid == 0)) {
            KdPrint(("MM:***PAGE FAULT AT IRQL > 1  Va %lx, IRQL %lx\n",VirtualAddress,
                PreviousIrql));

            //
            // use reserved bit to signal fatal error to trap handlers
            //

            return STATUS_IN_PAGE_ERROR | 0x10000000;

        }

        if (StoreInstruction && (PointerPte->u.Hard.CopyOnWrite != 0)) {
            KdPrint(("MM:***PAGE FAULT AT IRQL > 1  Va %lx, IRQL %lx\n",VirtualAddress,
                PreviousIrql));

            //
            // use reserved bit to signal fatal error to trap handlers
            //

            return STATUS_IN_PAGE_ERROR | 0x10000000;

        } else {

            //
            // The PTE is valid and accessable, another thread must
            // have faulted the PTE in already, or the access bit
            // is clear and this is a access fault; Blindly set the
            // access bit and dismiss the fault.
            //
#if DBG
            if (MmDebug & MM_DBG_SHOW_FAULTS) {
                DbgPrint("MM:no fault found - pte is %lx\n", PointerPte->u.Long);
            }
#endif //DBG

            MI_NO_FAULT_FOUND (TempPte, PointerPte, VirtualAddress, FALSE);
            return STATUS_SUCCESS;
        }
    }

    if (VirtualAddress >= (PVOID)MM_SYSTEM_RANGE_START) {

        //
        // This is a fault in the system address space.  User
        // mode access is not allowed.
        //

#if defined(_X86_) || defined(_ALPHA_) || defined(_PPC_)
        if (PreviousMode == UserMode) {
            return STATUS_ACCESS_VIOLATION;
        }
#endif // _X86_ || _ALPHA_ || _PPC_

RecheckPde:

        if (PointerPde->u.Hard.Valid == 1) {
#ifdef _X86_
            if (PointerPde->u.Hard.LargePage == 1) {
#if DBG
                if (MmLargePageFaultError < 10) {
                    DbgPrint ("MM - fault on Large page %lx\n",VirtualAddress);
                }
                MmLargePageFaultError += 1;
#endif //DBG
                return STATUS_SUCCESS;
            }
#endif //X86

            if (PointerPte->u.Hard.Valid == 1) {

                // Acquire the PFN lock, check to see if the address is still
                // valid if writable, update dirty bit.
                //

                LOCK_PFN (OldIrql);
                TempPte = *(volatile MMPTE *)PointerPte;
                if (TempPte.u.Hard.Valid == 1) {
                    MI_NO_FAULT_FOUND (TempPte, PointerPte, VirtualAddress, TRUE);
                }
                UNLOCK_PFN (OldIrql);
                return STATUS_SUCCESS;
            }
        } else {

            //
            // Due to G-bits in kernel mode code, accesses to paged pool
            // PDEs may not fault even though the PDE is not valid.  Make
            // sure the PDE is valid so PteFrames in the PFN database are
            // tracked properly.
            //

            MiCheckPdeForPagedPool (VirtualAddress);

            if (PointerPde->u.Hard.Valid == 0) {
                KeBugCheckEx (PAGE_FAULT_IN_NONPAGED_AREA,
                              (ULONG)VirtualAddress,
                              StoreInstruction,
                              PreviousMode,
                              2);
                return STATUS_SUCCESS;
            }

            //
            // Now that the PDE is valid, go look at the PTE again.
            //

            goto RecheckPde;
        }

        if ((VirtualAddress < (PVOID)PTE_BASE) ||
            (VirtualAddress > (PVOID)HYPER_SPACE_END)) {

            //
            // Acquire system working set lock.  While this lock
            // is held, no pages may go from valid to invalid.
            //
            // HOWEVER - transition pages may go to valid, but
            // may not be added to the working set list.  This
            // is done in the cache manager support routines to
            // shortcut faults on transition prototype PTEs.
            //

            if (PsGetCurrentThread() == MmSystemLockOwner) {

                //
                // Recursively trying to acquire the system working set
                // fast mutex - cause an IRQL > 1 bug check.
                //

                return STATUS_IN_PAGE_ERROR | 0x10000000;
            }

            LOCK_SYSTEM_WS (PreviousIrql);

            TempPte = *PointerPte;

#ifdef MIPS
            ASSERT ((TempPte.u.Hard.Global == 1) &&
                (PointerPde->u.Hard.Global == 1));
#endif //MIPS

            if (TempPte.u.Hard.Valid != 0) {

                //
                // PTE is already valid, return.
                //

                LOCK_PFN (OldIrql);
                TempPte = *(volatile MMPTE *)PointerPte;
                if (TempPte.u.Hard.Valid == 1) {
                    MI_NO_FAULT_FOUND (TempPte, PointerPte, VirtualAddress, TRUE);
                }
                UNLOCK_PFN (OldIrql);
                UNLOCK_SYSTEM_WS (PreviousIrql);
                return STATUS_SUCCESS;

            } else if (TempPte.u.Soft.Prototype != 0) {

                //
                // This is a PTE in prototype format, locate the coresponding
                // prototype PTE.
                //

                PointerProtoPte = MiPteToProto (&TempPte);
            } else if ((TempPte.u.Soft.Transition == 0) &&
                        (TempPte.u.Soft.Protection == 0)) {

                //
                // Page file format.  If the protection is ZERO, this
                // is a page of free system PTEs - bugcheck!
                //

                KeBugCheckEx (PAGE_FAULT_IN_NONPAGED_AREA,
                              (ULONG)VirtualAddress,
                              StoreInstruction,
                              PreviousMode,
                              0);
                return STATUS_SUCCESS;
            }
//fixfix remove this - also see procsup.c / mminpagekernelstack.
             else {
                 if (TempPte.u.Soft.Protection == 31) {
                    KeBugCheckEx (PAGE_FAULT_IN_NONPAGED_AREA,
                                  (ULONG)VirtualAddress,
                                  StoreInstruction,
                                  PreviousMode,
                                  0);

                 }
            }
//end of fixfix
            status = MiDispatchFault (StoreInstruction,
                                      VirtualAddress,
                                      PointerPte,
                                      PointerProtoPte,
                                      NULL);

            ASSERT (KeGetCurrentIrql() == APC_LEVEL);
            PageFrameIndex = MmSystemCacheWs.PageFaultCount;

            if (MmSystemCacheWs.AllowWorkingSetAdjustment == MM_GROW_WSLE_HASH) {
                MiGrowWsleHash (&MmSystemCacheWs, TRUE);
                LOCK_EXPANSION_IF_ALPHA (OldIrql);
                MmSystemCacheWs.AllowWorkingSetAdjustment = TRUE;
                UNLOCK_EXPANSION_IF_ALPHA (OldIrql);
            }
            UNLOCK_SYSTEM_WS (PreviousIrql);

            if ((PageFrameIndex & 0x3FFFF) == 0x30000) {

                //
                // The system cache is taking too many faults, delay
                // execution so modified page writer gets a quick shot and
                // increase the working set size.
                //

                KeDelayExecutionThread (KernelMode, FALSE, &MmShortTime);
            }
            return status;
        } else {
            if (MiCheckPdeForPagedPool (VirtualAddress) == STATUS_WAIT_1) {
                return STATUS_SUCCESS;
            }
        }
    }

    if (MmDelayPageFaults ||
        ((MmModifiedPageListHead.Total >= (MmModifiedPageMaximum + 100)) &&
        (MmAvailablePages < (1024*1024 / PAGE_SIZE)) &&
            (CurrentProcess->ModifiedPageCount > ((64*1024)/PAGE_SIZE)))) {

        //
        // This process has placed more than 64k worth of pages on the modified
        // list.  Delay for a short period and set the count to zero.
        //

        KeDelayExecutionThread (KernelMode,
                                FALSE,
             (CurrentProcess->Pcb.BasePriority < PROCESS_FOREGROUND_PRIORITY) ?
                                    &MmHalfSecond : &Mm30Milliseconds);
        CurrentProcess->ModifiedPageCount = 0;
    }

    //
    // FAULT IN USER SPACE OR PAGE TABLE PAGES.
    //

    //
    // Block APC's and acquire the working set lock.
    //

    KeRaiseIrql (APC_LEVEL, &PreviousIrql);


    LOCK_WS (CurrentProcess);

    //
    // Locate the Page Directory Entry which maps this virtual
    // address and check for accessability and validity.
    //

    //
    // Check to see if the page table page (PDE entry) is valid.
    // If not, the page table page must be made valid first.
    //

    if (PointerPde->u.Hard.Valid == 0) {

        //
        // If the PDE is zero, check to see if there is virtual address
        // mapped at this location, and if so create the necessary
        // structures to map it.
        //

        if ((PointerPde->u.Long == MM_ZERO_PTE) ||
            (PointerPde->u.Long == MM_ZERO_KERNEL_PTE)) {
            PointerProtoPte = MiCheckVirtualAddress (VirtualAddress,
                                                     &ProtectCode);

#ifdef LARGE_PAGES
            if (ProtectCode == MM_LARGE_PAGES) {
                status = STATUS_SUCCESS;
                goto ReturnStatus2;
            }
#endif //LARGE_PAGES

            if (ProtectCode == MM_NOACCESS) {
                status = STATUS_ACCESS_VIOLATION;
                MiCheckPdeForPagedPool (VirtualAddress);
                if (PointerPde->u.Hard.Valid == 1) {
                    status = STATUS_SUCCESS;
                }

#if DBG
                if ((MmDebug & MM_DBG_STOP_ON_ACCVIO) &&
                    (status == STATUS_ACCESS_VIOLATION)) {
                    DbgPrint("MM:access violation - %lx\n",VirtualAddress);
                    MiFormatPte(PointerPte);
                    DbgBreakPoint();
                }
#endif //DEBUG

                goto ReturnStatus2;

            } else {

                //
                // Build a demand zero PDE and operate on it.
                //

                *PointerPde = DemandZeroPde;
            }
        }

        //
        // The PDE is not valid, call the page fault routine passing
        // in the address of the PDE.  If the PDE is valid, determine
        // the status of the corresponding PTE.
        //

        status = MiDispatchFault (TRUE,  //page table page always written
                                  PointerPte,   //Virtual address
                                  PointerPde,   // PTE (PDE in this case)
                                  NULL,
                                  CurrentProcess);

        ASSERT (KeGetCurrentIrql() == APC_LEVEL);
        if (PointerPde->u.Hard.Valid == 0) {

            //
            // The PDE is not valid, return the status.
            //
            goto ReturnStatus1;
        }

        //KeFillEntryTb ((PHARDWARE_PTE)PointerPde, (PVOID)PointerPte, TRUE);

        MI_SET_PAGE_DIRTY (PointerPde, PointerPte, FALSE);

        //
        // Now that the PDE is accessable, get the PTE - let this fall
        // through.
        //
    }

    //
    // The PDE is valid and accessable, get the PTE contents.
    //

    TempPte = *PointerPte;
    if (TempPte.u.Hard.Valid != 0) {

        //
        // The PTE is valid and accessable, is this a write fault
        // copy on write or setting of some dirty bit?
        //

#if DBG
        if (MmDebug & MM_DBG_PTE_UPDATE) {
            MiFormatPte(PointerPte);
        }
#endif //DBG

        status = STATUS_SUCCESS;

        if (StoreInstruction) {

            //
            // This was a write operation.  If the copy on write
            // bit is set in the PTE perform the copy on write,
            // else check to ensure write access to the PTE.
            //

            if (TempPte.u.Hard.CopyOnWrite != 0) {
                MiCopyOnWrite (VirtualAddress, PointerPte);
                status = STATUS_PAGE_FAULT_COPY_ON_WRITE;
                goto ReturnStatus2;

            } else {
                if (TempPte.u.Hard.Write == 0) {
                    status = STATUS_ACCESS_VIOLATION;
                }
            }
#if DBG
        } else {

            //
            // The PTE is valid and accessable, another thread must
            // have faulted the PTE in already, or the access bit
            // is clear and this is a access fault; Blindly set the
            // access bit and dismiss the fault.
            //

            if (MmDebug & MM_DBG_SHOW_FAULTS) {
                DbgPrint("MM:no fault found - pte is %lx\n", PointerPte->u.Long);
            }
#endif //DBG
        }

        if (status == STATUS_SUCCESS) {
            LOCK_PFN (OldIrql);
            if (PointerPte->u.Hard.Valid != 0) {
                MI_NO_FAULT_FOUND (TempPte, PointerPte, VirtualAddress, TRUE);
            }
            UNLOCK_PFN (OldIrql);
        }

        goto ReturnStatus2;
    }

    //
    // If the PTE is zero, check to see if there is virtual address
    // mapped at this location, and if so create the necessary
    // structures to map it.
    //

    //
    // Check explicitly for demand zero pages.
    //

    if (TempPte.u.Long == MM_DEMAND_ZERO_WRITE_PTE) {
        MiResolveDemandZeroFault (VirtualAddress,
                                  PointerPte,
                                  CurrentProcess,
                                  0);

        status = STATUS_PAGE_FAULT_DEMAND_ZERO;
        goto ReturnStatus1;
    }

    if ((TempPte.u.Long == MM_ZERO_PTE) ||
        (TempPte.u.Long == MM_ZERO_KERNEL_PTE)) {

        //
        // PTE is needs to be evaluated with respect its virtual
        // address descriptor (VAD).  At this point there are 3
        // possiblities, bogus address, demand zero, or refers to
        // a prototype PTE.
        //

        PointerProtoPte = MiCheckVirtualAddress (VirtualAddress,
                                                 &ProtectionCode);
        if (ProtectionCode == MM_NOACCESS) {
            status = STATUS_ACCESS_VIOLATION;

            //
            // Check to make sure this is not a page table page for
            // paged pool which needs extending.
            //

            MiCheckPdeForPagedPool (VirtualAddress);
            if (PointerPte->u.Hard.Valid == 1) {
                status = STATUS_SUCCESS;
            }

#if DBG
            if ((MmDebug & MM_DBG_STOP_ON_ACCVIO) &&
                (status == STATUS_ACCESS_VIOLATION)) {
                DbgPrint("MM:access vio - %lx\n",VirtualAddress);
                MiFormatPte(PointerPte);
                DbgBreakPoint();
            }
#endif //DEBUG
            goto ReturnStatus2;
        }

        //
        // Increment the count of non-zero page table entires for this
        // page table.
        //

        if (VirtualAddress <= MM_HIGHEST_USER_ADDRESS) {
            MmWorkingSetList->UsedPageTableEntries
                                    [MiGetPdeOffset(VirtualAddress)] += 1;
        }

        //
        // Is this page a guard page?
        //

        if (ProtectionCode & MM_GUARD_PAGE) {

            //
            // This is a guard page exception.
            //

            PointerPte->u.Soft.Protection = ProtectionCode & ~MM_GUARD_PAGE;

            if (PointerProtoPte != NULL) {

                //
                // This is a prototype PTE, build the PTE to not
                // be a guard page.
                //

                PointerPte->u.Soft.PageFileHigh = 0xFFFFF;
                PointerPte->u.Soft.Prototype = 1;
            }

            UNLOCK_WS (CurrentProcess);
            KeLowerIrql (PreviousIrql);
            return MiCheckForUserStackOverflow (VirtualAddress);
        }

        if (PointerProtoPte == NULL) {

            //ASSERT (KeReadStateMutant (&CurrentProcess->WorkingSetLock) == 0);

            //
            // Assert that this is not for a PDE.
            //

            if (PointerPde == MiGetPdeAddress(PTE_BASE)) {

                //
                // This PTE is really a PDE, set contents as such.
                //

                *PointerPte = DemandZeroPde;
            } else {
                PointerPte->u.Soft.Protection = ProtectionCode;
            }

            LOCK_PFN (OldIrql);

            //
            // If a fork operation is in progress and the faulting thread
            // is not the thread performning the fork operation, block until
            // the fork is completed.
            //

            if ((CurrentProcess->ForkInProgress != NULL) &&
                (CurrentProcess->ForkInProgress != PsGetCurrentThread())) {
                MiWaitForForkToComplete (CurrentProcess);
                status = STATUS_SUCCESS;
                UNLOCK_PFN (OldIrql);
                goto ReturnStatus1;
            }

            if (!MiEnsureAvailablePageOrWait (CurrentProcess,
                                              VirtualAddress)) {

                ULONG Color;
                Color = MI_PAGE_COLOR_VA_PROCESS (VirtualAddress,
                                                &CurrentProcess->NextPageColor);
                PageFrameIndex = MiRemoveZeroPageIfAny (Color);
                if (PageFrameIndex == 0) {
                    PageFrameIndex = MiRemoveAnyPage (Color);
                    UNLOCK_PFN (OldIrql);
                    MiZeroPhysicalPage (PageFrameIndex, Color);
                    LOCK_PFN (OldIrql);
                }

                CurrentProcess->NumberOfPrivatePages += 1;
                MmInfoCounters.DemandZeroCount += 1;
                MiInitializePfn (PageFrameIndex, PointerPte, 1);

                UNLOCK_PFN (OldIrql);

                //
                // As this page is demand zero, set the modified bit in the
                // PFN database element and set the dirty bit in the PTE.
                //

                Pfn1 = MI_PFN_ELEMENT (PageFrameIndex);

                MI_MAKE_VALID_PTE (TempPte,
                                   PageFrameIndex,
                                   PointerPte->u.Soft.Protection,
                                   PointerPte);

                if (TempPte.u.Hard.Write != 0) {
                    MI_SET_PTE_DIRTY (TempPte);
                }

                *PointerPte = TempPte;

                ASSERT (Pfn1->u1.WsIndex == 0);
                Pfn1->u1.WsIndex = (ULONG)PsGetCurrentThread();
                WorkingSetIndex = MiLocateAndReserveWsle (&CurrentProcess->Vm);
                MiUpdateWsle (&WorkingSetIndex,
                              VirtualAddress,
                              MmWorkingSetList,
                              Pfn1);

                KeFillEntryTb ((PHARDWARE_PTE)PointerPte,
                                VirtualAddress,
                                FALSE);
            } else {
                UNLOCK_PFN (OldIrql);
            }

            status = STATUS_PAGE_FAULT_DEMAND_ZERO;
            goto ReturnStatus1;

        } else {

            //
            // This is a prototype PTE.
            //

            if (ProtectionCode == MM_UNKNOWN_PROTECTION) {

                //
                // The protection field is stored in the prototype PTE.
                //

                PointerPte->u.Long = MiProtoAddressForPte (PointerProtoPte);

            } else {

                *PointerPte = PrototypePte;
                PointerPte->u.Soft.Protection = ProtectionCode;
            }
            TempPte = *PointerPte;
        }

    } else {

        //
        // The PTE is non-zero and not valid, see if it is a prototype PTE.
        //

        ProtectionCode = TempPte.u.Soft.Protection;

        if (TempPte.u.Soft.Prototype != 0) {
            if (TempPte.u.Soft.PageFileHigh == 0xFFFFF) {
#if DBG
                MmProtoPteVadLookups += 1;
#endif //DBG
                PointerProtoPte = MiCheckVirtualAddress (VirtualAddress,
                                                         &ProtectCode);

            } else {
#if DBG
                MmProtoPteDirect += 1;
#endif //DBG

                //
                // Protection is in the prototype PTE, indicate an
                // access check should not be performed on the current PTE.
                //

                PointerProtoPte = MiPteToProto (&TempPte);
                ProtectionCode = MM_UNKNOWN_PROTECTION;

                //
                // Check to see if the proto protection has been overriden.
                //

                if (TempPte.u.Proto.ReadOnly != 0) {
                    ProtectionCode = MM_READONLY;
                }
            }
        }
    }

    if (ProtectionCode != MM_UNKNOWN_PROTECTION) {
        status = MiAccessCheck (PointerPte,
                                StoreInstruction,
                                PreviousMode,
                                ProtectionCode );

        if (status != STATUS_SUCCESS) {
#if DBG
            if ((MmDebug & MM_DBG_STOP_ON_ACCVIO) && (status == STATUS_ACCESS_VIOLATION)) {
                DbgPrint("MM:access violate - %lx\n",VirtualAddress);
                MiFormatPte(PointerPte);
                DbgBreakPoint();
            }
#endif //DEBUG

            UNLOCK_WS (CurrentProcess);
            KeLowerIrql (PreviousIrql);

            //
            // Check to see if this is a guard page violation
            // and if so, should the user's stack be extended.
            //

            if (status == STATUS_GUARD_PAGE_VIOLATION) {
                return MiCheckForUserStackOverflow (VirtualAddress);
            }

            return status;
        }
    }

    //
    // This is a page fault, invoke the page fault handler.
    //

    if (PointerProtoPte != NULL) {

        //
        // Lock page containing prototype PTEs in memory by
        // incrementing the reference count for the page.
        //


        if (!MI_IS_PHYSICAL_ADDRESS(PointerProtoPte)) {
            PointerPde = MiGetPteAddress (PointerProtoPte);
            LOCK_PFN (OldIrql);
            if (PointerPde->u.Hard.Valid == 0) {
                MiMakeSystemAddressValidPfn (PointerProtoPte);
            }
            Pfn1 = MI_PFN_ELEMENT (PointerPde->u.Hard.PageFrameNumber);
            Pfn1->u3.e2.ReferenceCount += 1;
            ASSERT (Pfn1->u3.e2.ReferenceCount > 1);
            UNLOCK_PFN (OldIrql);
        }
    }
    status = MiDispatchFault (StoreInstruction,
                              VirtualAddress,
                              PointerPte,
                              PointerProtoPte,
                              CurrentProcess);

    if (PointerProtoPte != NULL) {

        //
        // Unlock page containing prototype PTEs.
        //

        if (!MI_IS_PHYSICAL_ADDRESS(PointerProtoPte)) {
            LOCK_PFN (OldIrql);
            ASSERT (Pfn1->u3.e2.ReferenceCount > 1);
            Pfn1->u3.e2.ReferenceCount -= 1;
            UNLOCK_PFN (OldIrql);
        }
    }

ReturnStatus1:

    ASSERT (KeGetCurrentIrql() <= APC_LEVEL);
    if (CurrentProcess->Vm.AllowWorkingSetAdjustment == MM_GROW_WSLE_HASH) {
        MiGrowWsleHash (&CurrentProcess->Vm, FALSE);
        LOCK_EXPANSION_IF_ALPHA (OldIrql);
        CurrentProcess->Vm.AllowWorkingSetAdjustment = TRUE;
        UNLOCK_EXPANSION_IF_ALPHA (OldIrql);
    }

ReturnStatus2:

    PageFrameIndex = CurrentProcess->Vm.PageFaultCount;

    UNLOCK_WS (CurrentProcess);
    KeLowerIrql (PreviousIrql);

    if ((PageFrameIndex & 0x3FFFF) == 0x30000) {
        if (PsGetCurrentThread()->Tcb.Priority >= LOW_REALTIME_PRIORITY) {

            //
            // This thread is realtime and taking many faults, delay
            // execution so modified page writer gets a quick shot and
            // increase the working set size.
            //

            KeDelayExecutionThread (KernelMode, FALSE, &MmShortTime);
            MmAdjustWorkingSetSize (
                    (CurrentProcess->Vm.MinimumWorkingSetSize + 10) << PAGE_SHIFT,
                    (CurrentProcess->Vm.MaximumWorkingSetSize + 10) << PAGE_SHIFT,
                    FALSE);
        }
    }

    return status;
}