path: root/private/ntos/mm/sectsup.c

/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

   sectsup.c

Abstract:

    This module contains the routines which implement the
    section object.

Author:

    Lou Perazzoli (loup) 22-May-1989

Revision History:

--*/


#include "mi.h"

#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT,MiSectionInitialization)
#endif

MMEVENT_COUNT_LIST MmEventCountList;

NTSTATUS
MiFlushSectionInternal (
    IN PMMPTE StartingPte,
    IN PMMPTE FinalPte,
    IN PSUBSECTION FirstSubsection,
    IN PSUBSECTION LastSubsection,
    IN ULONG Synchronize,
    OUT PIO_STATUS_BLOCK IoStatus
    );

ULONG
FASTCALL
MiCheckProtoPtePageState (
    IN PMMPTE PrototypePte,
    IN ULONG PfnLockHeld
    );

ULONG MmSharedCommit = 0;
extern ULONG MMCONTROL;

//
// Define segment dereference thread wait object types.
//

typedef enum _SEGMENT_DERFERENCE_OBJECT {
    SegmentDereference,
    UsedSegmentCleanup,
    SegMaximumObject
    } BALANCE_OBJECT;

extern POBJECT_TYPE IoFileObjectType;

GENERIC_MAPPING MiSectionMapping = {
    STANDARD_RIGHTS_READ |
        SECTION_QUERY | SECTION_MAP_READ,
    STANDARD_RIGHTS_WRITE |
        SECTION_MAP_WRITE,
    STANDARD_RIGHTS_EXECUTE |
        SECTION_MAP_EXECUTE,
    SECTION_ALL_ACCESS
};

VOID
VadTreeWalk (
    PMMVAD Start
    );

VOID
MiRemoveUnusedSegments(
    VOID
    );


VOID
FASTCALL
MiInsertBasedSection (
    IN PSECTION Section
    )

/*++

Routine Description:

    This function inserts a virtual address descriptor into the tree and
    reorders the splay tree as appropriate.

Arguments:

    Section - Supplies a pointer to a based section.

Return Value:

    None.

Environment:

    Must be holding the section based mutex.

--*/

{
    PMMADDRESS_NODE *Root;

    ASSERT (Section->Address.EndingVa > Section->Address.StartingVa);

    Root = &MmSectionBasedRoot;

    MiInsertNode ( &Section->Address, Root);
    return;
}


VOID
FASTCALL
MiRemoveBasedSection (
    IN PSECTION Section
    )

/*++

Routine Description:

    This function removes a based section from the tree.

Arguments:

    Section - pointer to the based section object to remove.

Return Value:

    None.

Environment:

    Must be holding the section based mutex.

--*/

{
    PMMADDRESS_NODE *Root;

    Root = &MmSectionBasedRoot;

    MiRemoveNode ( &Section->Address, Root);

    return;
}


PVOID
MiFindEmptySectionBaseDown (
    IN ULONG SizeOfRange,
    IN PVOID HighestAddressToEndAt
    )

/*++

Routine Description:

    The function examines the virtual address descriptors to locate
    an unused range of the specified size and returns the starting
    address of the range.  This routine looks from the top down.

Arguments:

    SizeOfRange - Supplies the size in bytes of the range to locate.

    HighestAddressToEndAt - Supplies the virtual address to begin looking
                            at.

Return Value:

    Returns the starting address of a suitable range.

--*/

{
    return MiFindEmptyAddressRangeDownTree ( SizeOfRange,
                    HighestAddressToEndAt,
                    X64K,
                    MmSectionBasedRoot);
}


VOID
MiSegmentDelete (
    PSEGMENT Segment
    )

/*++

Routine Description:

    This routine is called by the object management procedures whenever
    the last reference to a segment object has been removed.  This routine
    releases the pool allocated for the prototype PTEs and performs
    consistency checks on those PTEs.

    For segments which map files, the file object is dereferenced.

    Note, that for a segment which maps a file, no PTEs may be valid
    or transition, while a segment which is backed by a paging file
    may have transition pages, but no valid pages (there can be no
    PTEs which refer to the segment).


Arguments:

    Segment - a pointer to the segment structure.

Return Value:

    None.

--*/

{
    PMMPTE PointerPte;
    PMMPTE LastPte;
    PMMPFN Pfn1;
    KIRQL OldIrql;
    KIRQL OldIrql2;
    volatile PFILE_OBJECT File;
    volatile PCONTROL_AREA ControlArea;
    PEVENT_COUNTER Event;
    MMPTE PteContents;
    PSUBSECTION Subsection;
    PSUBSECTION NextSubsection;

    PointerPte = Segment->PrototypePte;
    LastPte = PointerPte + Segment->NonExtendedPtes;

#if DBG
    if (MmDebug & MM_DBG_SECTIONS) {
        DbgPrint("MM:deleting segment %lx control %lx\n",Segment, Segment->ControlArea);
    }
#endif

    ControlArea = Segment->ControlArea;
    LOCK_PFN (OldIrql2);
    if (ControlArea->DereferenceList.Flink != NULL) {

        //
        // Remove this from the list of usused segments.
        //

        ExAcquireSpinLock (&MmDereferenceSegmentHeader.Lock, &OldIrql);
        RemoveEntryList (&ControlArea->DereferenceList);
        MmUnusedSegmentCount -= 1;
        ExReleaseSpinLock (&MmDereferenceSegmentHeader.Lock, OldIrql);
    }
    UNLOCK_PFN (OldIrql2);

    if (ControlArea->u.Flags.Image ||
        ControlArea->u.Flags.File ) {

        //
        // If there have been committed pages in this segment, adjust
        // the total commit count.
        //


        //
        // Unload kernel debugger symbols if any where loaded.
        //

        if (ControlArea->u.Flags.DebugSymbolsLoaded != 0) {

            //
            //  TEMP TEMP TEMP rip out when debugger converted
            //

            ANSI_STRING AnsiName;
            NTSTATUS Status;

            Status = RtlUnicodeStringToAnsiString( &AnsiName,
                                                   (PUNICODE_STRING)&Segment->ControlArea->FilePointer->FileName,
                                                   TRUE );

            if (NT_SUCCESS( Status)) {
                DbgUnLoadImageSymbols( &AnsiName,
                                       Segment->BasedAddress,
                                       (ULONG)PsGetCurrentProcess());
                RtlFreeAnsiString( &AnsiName );
            }
            LOCK_PFN (OldIrql);
            ControlArea->u.Flags.DebugSymbolsLoaded = 0;
            UNLOCK_PFN (OldIrql);
        }

        //
        // If the segment was deleted due to a name collision at insertion
        // we don't want to dereference the file pointer.
        //

        if (ControlArea->u.Flags.BeingCreated == FALSE) {

            //
            // Clear the segment context and dereference the file object
            // for this Segment.
            //

            LOCK_PFN (OldIrql);

            MiMakeSystemAddressValidPfn (Segment);
            File = (volatile PFILE_OBJECT)Segment->ControlArea->FilePointer;
            ControlArea = (volatile PCONTROL_AREA)Segment->ControlArea;

            Event = ControlArea->WaitingForDeletion;
            ControlArea->WaitingForDeletion = NULL;

            UNLOCK_PFN (OldIrql);

            if (Event != NULL) {
                KeSetEvent (&Event->Event, 0, FALSE);
            }

#if DBG
            if (ControlArea->u.Flags.Image == 1) {
                ASSERT (ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject != (PVOID)ControlArea);
            } else {
                ASSERT (ControlArea->FilePointer->SectionObjectPointer->DataSectionObject != (PVOID)ControlArea);
            }
#endif //DBG

            ObDereferenceObject (ControlArea->FilePointer);
        }

        if (ControlArea->u.Flags.Image == 0) {

            //
            // This is a mapped data file.  None of the prototype
            // PTEs may be referencing a physical page (valid or transition).
            //

#if DBG
            while (PointerPte < LastPte) {

                //
                // Prototype PTEs for Segments backed by paging file
                // are either in demand zero, page file format, or transition.
                //

                ASSERT (PointerPte->u.Hard.Valid == 0);
                ASSERT ((PointerPte->u.Soft.Prototype == 1) ||
                        (PointerPte->u.Long == 0));
                PointerPte += 1;
            }
#endif //DBG

            //
            // Deallocate the control area and subsections.
            //

            Subsection = (PSUBSECTION)(ControlArea + 1);

            Subsection = Subsection->NextSubsection;

            while (Subsection != NULL) {
                ExFreePool (Subsection->SubsectionBase);
                NextSubsection = Subsection->NextSubsection;
                ExFreePool (Subsection);
                Subsection = NextSubsection;
            }

            if (Segment->NumberOfCommittedPages != 0) {
                MiReturnCommitment (Segment->NumberOfCommittedPages);
                MmSharedCommit -= Segment->NumberOfCommittedPages;
            }

            RtlZeroMemory (Segment->ControlArea, sizeof (CONTROL_AREA)); //fixfix remove
            ExFreePool (Segment->ControlArea);
            RtlZeroMemory (Segment, sizeof (SEGMENT)); //fixfix remove
            ExFreePool (Segment);

            //
            // The file mapped Segment object is now deleted.
            //

            return;
        }
    }

    //
    // This is a page file backed or image Segment.  The Segment is being
    // deleted, remove all references to the paging file and physical memory.
    //

    //
    // The PFN mutex is required for deallocating pages from a paging
    // file and for deleting transition PTEs.
    //

    LOCK_PFN (OldIrql);

    MiMakeSystemAddressValidPfn (PointerPte);

    while (PointerPte < LastPte) {

        if (((ULONG)PointerPte & (PAGE_SIZE - 1)) == 0) {

            //
            // We are on a page boundary, make sure this PTE is resident.
            //

            if (MmIsAddressValid (PointerPte) == FALSE) {

                MiMakeSystemAddressValidPfn (PointerPte);
            }
        }

        PteContents = *PointerPte;

        //
        // Prototype PTEs for Segments backed by paging file
        // are either in demand zero, page file format, or transition.
        //

        ASSERT (PteContents.u.Hard.Valid == 0);

        if (PteContents.u.Soft.Prototype == 0) {

            if (PteContents.u.Soft.Transition == 1) {

                //
                // Prototype PTE in transition, put the page on the free list.
                //

                Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);

                MI_SET_PFN_DELETED (Pfn1);

                MiDecrementShareCount (Pfn1->PteFrame);

                //
                // Check the reference count for the page, if the reference
                // count is zero and the page is not on the freelist,
                // move the page to the free list, if the reference
                // count is not zero, ignore this page.
                // When the refernce count goes to zero, it will be placed on the
                // free list.
                //

                if (Pfn1->u3.e2.ReferenceCount == 0) {
                    MiUnlinkPageFromList (Pfn1);
                    MiReleasePageFileSpace (Pfn1->OriginalPte);
                    MiInsertPageInList (MmPageLocationList[FreePageList],
                                        PteContents.u.Trans.PageFrameNumber);
                }

            } else {

                //
                // This is not a prototype PTE, if any paging file
                // space has been allocated, release it.
                //

                if (IS_PTE_NOT_DEMAND_ZERO (PteContents)) {
                    MiReleasePageFileSpace (PteContents);
                }
            }
        }
#if DBG
        *PointerPte = ZeroPte;
#endif
        PointerPte += 1;
    }

    UNLOCK_PFN (OldIrql);

    //
    // If their have been committed pages in this segment, adjust
    // the total commit count.
    //

    if (Segment->NumberOfCommittedPages != 0) {
        MiReturnCommitment (Segment->NumberOfCommittedPages);
        MmSharedCommit -= Segment->NumberOfCommittedPages;
    }

    ExFreePool (Segment->ControlArea);
    ExFreePool (Segment);

    return;
}

VOID
MiSectionDelete (
    PVOID Object
    )

/*++

Routine Description:


    This routine is called by the object management procedures whenever
    the last reference to a section object has been removed.  This routine
    dereferences the associated segment object and checks to see if
    the segment object should be deleted by queueing the segment to the
    segment deletion thread.

Arguments:

    Object - a pointer to the body of the section object.

Return Value:

    None.

--*/

{
    PSECTION Section;
    volatile PCONTROL_AREA ControlArea;
    ULONG DereferenceSegment = FALSE;
    KIRQL OldIrql;
    ULONG UserRef;

    Section = (PSECTION)Object;

    if (Section->Segment == (PSEGMENT)NULL) {

        //
        // The section was never initialized, no need to remove
        // any structures.
        //
        return;
    }

    UserRef = Section->u.Flags.UserReference;
    ControlArea = (volatile PCONTROL_AREA)Section->Segment->ControlArea;

#if DBG
    if (MmDebug & MM_DBG_SECTIONS) {
        DbgPrint("MM:deleting section %lx control %lx\n",Section, ControlArea);
    }
#endif

    if (Section->Address.StartingVa != NULL) {

        //
        // This section is based, remove the base address from the
        // treee.
        //

        //
        // Get the allocation base mutex.
        //

        ExAcquireFastMutex (&MmSectionBasedMutex);

        MiRemoveBasedSection (Section);

        ExReleaseFastMutex (&MmSectionBasedMutex);

    }

    //
    // Decrement the number of section references to the segment for this
    // section.  This requires APCs to be blocked and the PfnMutex to
    // synchonize upon.
    //

    LOCK_PFN (OldIrql);

    ControlArea->NumberOfSectionReferences -= 1;
    ControlArea->NumberOfUserReferences -= UserRef;

    //
    // This routine returns with the PFN lock released.
    //

    MiCheckControlArea (ControlArea, NULL, OldIrql);

    return;
}


VOID
MiDereferenceSegmentThread (
    IN PVOID StartContext
    )

/*++

Routine Description:

    This routine is the thread for derefencing segments which have
    no references from any sections or mapped views AND there are
    no prototype PTEs within the segment which are in the transition
    state (i.e., no PFN database references to the segment).

    It also does double duty and is used for expansion of paging files.

Arguments:

    StartContext - Not used.

Return Value:

    None.

--*/

{
    PCONTROL_AREA ControlArea;
    PMMPAGE_FILE_EXPANSION PageExpand;
    PLIST_ENTRY NextEntry;
    KIRQL OldIrql;
    static KWAIT_BLOCK WaitBlockArray[SegMaximumObject];
    PVOID WaitObjects[SegMaximumObject];
    NTSTATUS Status;

    StartContext;  //avoid compiler warning.

    //
    // Make this a real time thread.
    //

    (VOID) KeSetPriorityThread (&PsGetCurrentThread()->Tcb,
                                LOW_REALTIME_PRIORITY + 2);

    WaitObjects[SegmentDereference] = (PVOID)&MmDereferenceSegmentHeader.Semaphore;
    WaitObjects[UsedSegmentCleanup] = (PVOID)&MmUnusedSegmentCleanup;

    for (;;) {

        Status = KeWaitForMultipleObjects(SegMaximumObject,
                                          &WaitObjects[0],
                                          WaitAny,
                                          WrVirtualMemory,
                                          UserMode,
                                          FALSE,
                                          NULL,
                                          &WaitBlockArray[0]);

        //
        // Switch on the wait status.
        //

        switch (Status) {

        case SegmentDereference:

            //
            // An entry is available to deference, acquire the spinlock
            // and remove the entry.
            //

            ExAcquireSpinLock (&MmDereferenceSegmentHeader.Lock, &OldIrql);

            if (IsListEmpty(&MmDereferenceSegmentHeader.ListHead)) {

                //
                // There is nothing in the list, rewait.
                //

                ExReleaseSpinLock (&MmDereferenceSegmentHeader.Lock, OldIrql);
                break;
            }

            NextEntry = RemoveHeadList(&MmDereferenceSegmentHeader.ListHead);

            ExReleaseSpinLock (&MmDereferenceSegmentHeader.Lock, OldIrql);

            ASSERT (KeGetCurrentIrql() < DISPATCH_LEVEL);

            ControlArea = CONTAINING_RECORD( NextEntry,
                                             CONTROL_AREA,
                                             DereferenceList );

            if (ControlArea->Segment != NULL) {

                //
                // This is a control area, delete it.
                //

#if DBG
                if (MmDebug & MM_DBG_SECTIONS) {
                    DbgPrint("MM:dereferencing segment %lx control %lx\n",
                        ControlArea->Segment, ControlArea);
                }
#endif

                //
                // Indicate this entry is not on any list.
                //

                ControlArea->DereferenceList.Flink = NULL;

                ASSERT (ControlArea->u.Flags.FilePointerNull == 1);
                MiSegmentDelete (ControlArea->Segment);

            } else {

                //
                // This is a request to expand or reduce the paging files.
                //

                PageExpand = (PMMPAGE_FILE_EXPANSION)ControlArea;

                if (PageExpand->RequestedExpansionSize == 0xFFFFFFFF) {

                    //
                    // Attempt to reduce the size of the paging files.
                    //

                    ExFreePool (PageExpand);

                    MiAttemptPageFileReduction ();
                } else {

                    //
                    // Attempt to expand the size of the paging files.
                    //

                    PageExpand->ActualExpansion = MiExtendPagingFiles (
                                                PageExpand->RequestedExpansionSize);

                    KeSetEvent (&PageExpand->Event, 0, FALSE);
                    MiRemoveUnusedSegments();
                }
            }
            break;

        case UsedSegmentCleanup:

            MiRemoveUnusedSegments();

            KeClearEvent (&MmUnusedSegmentCleanup);

            break;

        default:

            KdPrint(("MMSegmentderef: Illegal wait status, %lx =\n", Status));
            break;
        } // end switch

    } //end for

    return;
}


ULONG
MiSectionInitialization (
    )

/*++

Routine Description:

    This function creates the section object type descriptor at system
    initialization and stores the address of the object type descriptor
    in global storage.

Arguments:

    None.

Return Value:

    TRUE - Initialization was successful.

    FALSE - Initialization Failed.



--*/

{
    OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
    UNICODE_STRING TypeName;
    HANDLE ThreadHandle;
    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING SectionName;
    PSECTION Section;
    HANDLE Handle;
    PSEGMENT Segment;
    PCONTROL_AREA ControlArea;
    NTSTATUS Status;

    MmSectionBasedRoot = (PMMADDRESS_NODE)NULL;

    //
    // Initialize the common fields of the Object Type Initializer record
    //

    RtlZeroMemory( &ObjectTypeInitializer, sizeof( ObjectTypeInitializer ) );
    ObjectTypeInitializer.Length = sizeof( ObjectTypeInitializer );
    ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
    ObjectTypeInitializer.GenericMapping = MiSectionMapping;
    ObjectTypeInitializer.PoolType = PagedPool;
    ObjectTypeInitializer.DefaultPagedPoolCharge = sizeof(SECTION);

    //
    // Initialize string descriptor.
    //

    RtlInitUnicodeString (&TypeName, L"Section");

    //
    // Create the section object type descriptor
    //

    ObjectTypeInitializer.ValidAccessMask = SECTION_ALL_ACCESS;
    ObjectTypeInitializer.DeleteProcedure = MiSectionDelete;
    ObjectTypeInitializer.GenericMapping = MiSectionMapping;
    ObjectTypeInitializer.UseDefaultObject = TRUE;
    if ( !NT_SUCCESS(ObCreateObjectType(&TypeName,
                                     &ObjectTypeInitializer,
                                     (PSECURITY_DESCRIPTOR) NULL,
                                     &MmSectionObjectType
                                     )) ) {
        return FALSE;
    }

    //
    // Initialize listhead, spinlock and semaphore for
    // segment dereferencing thread.
    //

    KeInitializeSpinLock (&MmDereferenceSegmentHeader.Lock);
    InitializeListHead (&MmDereferenceSegmentHeader.ListHead);
    KeInitializeSemaphore (&MmDereferenceSegmentHeader.Semaphore, 0, MAXLONG);

    InitializeListHead (&MmUnusedSegmentList);
    KeInitializeEvent (&MmUnusedSegmentCleanup, NotificationEvent, FALSE);

    //
    // Create the Segment deferencing thread.
    //

    InitializeObjectAttributes( &ObjectAttributes,
                                NULL,
                                0,
                                NULL,
                                NULL );

    if ( !NT_SUCCESS(PsCreateSystemThread(
                    &ThreadHandle,
                    THREAD_ALL_ACCESS,
                    &ObjectAttributes,
                    0,
                    NULL,
                    MiDereferenceSegmentThread,
                    NULL
                    )) ) {
        return FALSE;
    }
    ZwClose (ThreadHandle);

    //
    // Create the permanent section which maps physical memory.
    //

    Segment = (PSEGMENT)ExAllocatePoolWithTag (PagedPool,
                                               sizeof(SEGMENT),
                                               'gSmM');
    if (Segment == NULL) {
        return FALSE;
    }

    ControlArea = ExAllocatePoolWithTag (NonPagedPool,
                                         (ULONG)sizeof(CONTROL_AREA),
                                         MMCONTROL);
    if (ControlArea == NULL) {
        return FALSE;
    }

    RtlZeroMemory (Segment, sizeof(SEGMENT));
    RtlZeroMemory (ControlArea, sizeof(CONTROL_AREA));

    ControlArea->Segment = Segment;
    ControlArea->NumberOfSectionReferences = 1;
    ControlArea->u.Flags.PhysicalMemory = 1;

    Segment->ControlArea = ControlArea;
    Segment->SegmentPteTemplate = ZeroPte;

    //
    // Now that the segment object is created, create a section object
    // which refers to the segment object.
    //

    RtlInitUnicodeString (&SectionName, L"\\Device\\PhysicalMemory");

    InitializeObjectAttributes( &ObjectAttributes,
                                &SectionName,
                                OBJ_PERMANENT,
                                NULL,
                                NULL
                              );

    Status = ObCreateObject (KernelMode,
                             MmSectionObjectType,
                             &ObjectAttributes,
                             KernelMode,
                             NULL,
                             sizeof(SECTION),
                             sizeof(SECTION),
                             0,
                             (PVOID *)&Section);
    if (!NT_SUCCESS(Status)) {
        return FALSE;
    }

    Section->Segment = Segment;
    Section->SizeOfSection.QuadPart = ((LONGLONG)1 << PHYSICAL_ADDRESS_BITS) - 1;
    Section->u.LongFlags = 0;
    Section->InitialPageProtection = PAGE_READWRITE;

    Status = ObInsertObject ((PVOID)Section,
                                    NULL,
                                    SECTION_MAP_READ,
                                    0,
                                    (PVOID *)NULL,
                                    &Handle);

    if (!NT_SUCCESS( Status )) {
        return FALSE;
    }

    if ( !NT_SUCCESS (NtClose ( Handle))) {
        return FALSE;
    }

    return TRUE;
}

BOOLEAN
MmForceSectionClosed (
    IN PSECTION_OBJECT_POINTERS SectionObjectPointer,
    IN BOOLEAN DelayClose
    )

/*++

Routine Description:

    This function examines the Section object pointers.  If they are NULL,
    no further action is taken and the value TRUE is returned.

    If the Section object pointer is not NULL, the section reference count
    and the map view count are checked. If both counts are zero, the
    segment associated with the file is deleted and the file closed.
    If one of the counts is non-zero, no action is taken and the
    value FALSE is returned.

Arguments:

    SectionObjectPointer - Supplies a pointer to a section object.

    DelayClose - Supplies the value TRUE if the close operation should
                 occur as soon as possible in the event this section
                 cannot be closed now due to outstanding references.

Return Value:

    TRUE - the segment was deleted and the file closed or no segment was
           located.

    FALSE - the segment was not deleted and no action was performed OR
            an I/O error occurred trying to write the pages.

--*/

{
    PCONTROL_AREA ControlArea;
    KIRQL OldIrql;
    ULONG state;

    //
    // Check the status of the control area, if the control area is in use
    // or the control area is being deleted, this operation cannot continue.
    //

    state = MiCheckControlAreaStatus (CheckBothSection,
                                      SectionObjectPointer,
                                      DelayClose,
                                      &ControlArea,
                                      &OldIrql);

    if (ControlArea == NULL) {
        return (BOOLEAN)state;
    }

    //
    // PFN LOCK IS NOW HELD!
    //

    //
    // Set the being deleted flag and up the number of mapped views
    // for the segment.  Upping the number of mapped views prevents
    // the segment from being deleted and passed to the deletion thread
    // while we are forcing a delete.
    //

    ControlArea->u.Flags.BeingDeleted = 1;
    ASSERT (ControlArea->NumberOfMappedViews == 0);
    ControlArea->NumberOfMappedViews = 1;

    //
    // This is a page file backed or image Segment.  The Segment is being
    // deleted, remove all references to the paging file and physical memory.
    //

    UNLOCK_PFN (OldIrql);

    //
    // Delete the section by flushing all modified pages back to the section
    // if it is a file and freeing up the pages such that the PfnReferenceCount
    // goes to zero.
    //

    MiCleanSection (ControlArea);
    return TRUE;
}

VOID
MiCleanSection (
    IN PCONTROL_AREA ControlArea
    )

/*++

Routine Description:

    This function examines each prototype PTE in the section and
    takes the appropriate action to "delete" the prototype PTE.

    If the PTE is dirty and is backed by a file (not a paging file),
    the corresponding page is written to the file.

    At the completion of this service, the section which was
    operated upon is no longer usable.

    NOTE - ALL I/O ERRORS ARE IGNORED.  IF ANY WRITES FAIL, THE
           DIRTY PAGES ARE MARKED CLEAN AND THE SECTION IS DELETED.

Arguments:

    ControlArea - Supplies a pointer to the control area for the section.

Return Value:

    None.

--*/

{
    PMMPTE PointerPte;
    PMMPTE LastPte;
    PMMPTE LastWritten;
    MMPTE PteContents;
    PMMPFN Pfn1;
    PMMPFN Pfn2;
    PMMPTE WrittenPte;
    MMPTE WrittenContents;
    KIRQL OldIrql;
    PMDL Mdl;
    PKEVENT IoEvent;
    PSUBSECTION Subsection;
    PULONG Page;
    PULONG LastPage;
    PULONG EndingPage;
    LARGE_INTEGER StartingOffset;
    LARGE_INTEGER TempOffset;
    NTSTATUS Status;
    IO_STATUS_BLOCK IoStatus;
    ULONG WriteNow = FALSE;
    ULONG ImageSection = FALSE;
    ULONG DelayCount = 0;
    ULONG First;

    if (ControlArea->u.Flags.Image) {
        ImageSection = TRUE;
    }
    ASSERT (ControlArea->FilePointer);

    PointerPte = ControlArea->Segment->PrototypePte;
    LastPte = PointerPte + ControlArea->Segment->NonExtendedPtes;

    IoEvent = ExAllocatePoolWithTag (NonPagedPoolMustSucceed,
                              MmSizeOfMdl(NULL, PAGE_SIZE *
                                                    MmModifiedWriteClusterSize)
                                                    + sizeof(KEVENT),
                                                    'ldmM');

    Mdl = (PMDL)(IoEvent + 1);

    KeInitializeEvent (IoEvent, NotificationEvent, FALSE);

    LastWritten = NULL;
    EndingPage = (PULONG)(Mdl + 1) + MmModifiedWriteClusterSize;
    LastPage = NULL;

    Subsection = (PSUBSECTION)(ControlArea + 1);

    //
    // The PFN mutex is required for deallocating pages from a paging
    // file and for deleting transition PTEs.
    //

    LOCK_PFN (OldIrql);

    //
    // Stop the modified page writer from writting pages to this
    // file, and if any paging I/O is in progress, wait for it
    // to complete.
    //

    ControlArea->u.Flags.NoModifiedWriting = 1;

    while (ControlArea->ModifiedWriteCount != 0) {

        //
        // There is modified page writting in progess.  Set the
        // flag in the control area indicating the modified page
        // writer should signal when a write to this control area
        // is complete.  Release the PFN LOCK and wait in an
        // atomic operation.  Once the wait is satified, recheck
        // to make sure it was this file's I/O that was written.
        //

        ControlArea->u.Flags.SetMappedFileIoComplete = 1;
        KeEnterCriticalRegion();
        UNLOCK_PFN_AND_THEN_WAIT(OldIrql);

        KeWaitForSingleObject(&MmMappedFileIoComplete,
                              WrPageOut,
                              KernelMode,
                              FALSE,
                              (PLARGE_INTEGER)NULL);
        KeLeaveCriticalRegion();
        LOCK_PFN (OldIrql);
    }

 for (;;) {

    First = TRUE;
    while (PointerPte < LastPte) {

        if ((((ULONG)PointerPte & (PAGE_SIZE - 1)) == 0) || First) {
            First = FALSE;

            if ((ImageSection) ||
                (MiCheckProtoPtePageState(PointerPte, FALSE))) {
                MiMakeSystemAddressValidPfn (PointerPte);
            } else {

                //
                // Paged pool page is not resident, hence no transition or valid
                // prototype PTEs can be present in it.  Skip it.
                //

                PointerPte = (PMMPTE)((((ULONG)PointerPte | PAGE_SIZE - 1)) + 1);
                if (LastWritten != NULL) {
                    WriteNow = TRUE;
                }
                goto WriteItOut;
            }
        }

        PteContents = *PointerPte;

        //
        // Prototype PTEs for Segments backed by paging file
        // are either in demand zero, page file format, or transition.
        //

        ASSERT (PteContents.u.Hard.Valid == 0);

        if (PteContents.u.Soft.Prototype == 0) {

            if (PteContents.u.Soft.Transition == 1) {

                //
                // Prototype PTE in transition, there are 3 possible cases:
                //  1. The page is part of an image which is shareable and
                //     refers to the paging file - dereference page file
                //     space and free the physical page.
                //  2. The page refers to the segment but is not modified -
                //     free the phyisical page.
                //  3. The page refers to the segment and is modified -
                //     write the page to the file and free the physical page.
                //

                Pfn1 = MI_PFN_ELEMENT (PteContents.u.Trans.PageFrameNumber);

                if (Pfn1->u3.e2.ReferenceCount != 0) {
                    if (DelayCount < 20) {

                        //
                        // There must be an I/O in progress on this
                        // page.  Wait for the I/O operation to complete.
                        //

                        UNLOCK_PFN (OldIrql);

                        KeDelayExecutionThread (KernelMode, FALSE, &MmShortTime);

                        DelayCount += 1;

                        //
                        // Redo the loop, if the delay count is greater than
                        // 20, assume that this thread is deadlocked and
                        // don't purge this page.  The file system can deal
                        // with the write operation in progress.
                        //

                        LOCK_PFN (OldIrql);
                        MiMakeSystemAddressValidPfn (PointerPte);
                        continue;
#if DBG
                    } else {

                        //
                        // The I/O still has not completed, just ignore the fact
                        // that the i/o is in progress and delete the page.
                        //

                        KdPrint(("MM:CLEAN - page number %lx has i/o outstanding\n",
                                  PteContents.u.Trans.PageFrameNumber));
#endif //DBG
                    }
                }

                if (Pfn1->OriginalPte.u.Soft.Prototype == 0) {

                    //
                    // Paging file reference (case 1).
                    //

                    MI_SET_PFN_DELETED (Pfn1);
                    if (!ImageSection) {

                        //
                        // This is not an image section, it must be a
                        // page file backed section, therefore decrement
                        // the PFN reference count for the control area.
                        //

                        ControlArea->NumberOfPfnReferences -= 1;
                        ASSERT ((LONG)ControlArea->NumberOfPfnReferences >= 0);
                    }

                    MiDecrementShareCount (Pfn1->PteFrame);

                    //
                    // Check the reference count for the page, if the reference
                    // count is zero and the page is not on the freelist,
                    // move the page to the free list, if the reference
                    // count is not zero, ignore this page.
                    // When the refernce count goes to zero, it will be placed
                    // on the free list.
                    //

                    if ((Pfn1->u3.e2.ReferenceCount == 0) &&
                         (Pfn1->u3.e1.PageLocation != FreePageList)) {

                        MiUnlinkPageFromList (Pfn1);
                        MiReleasePageFileSpace (Pfn1->OriginalPte);
                        MiInsertPageInList (MmPageLocationList[FreePageList],
                                    PteContents.u.Trans.PageFrameNumber);

                    }
                    PointerPte->u.Long = 0;

                    //
                    // If a cluster of pages to write has been completed,
                    // set the WriteNow flag.
                    //

                    if (LastWritten != NULL) {
                        WriteNow = TRUE;
                    }

                } else {

                    if ((Pfn1->u3.e1.Modified == 0) || (ImageSection)) {

                        //
                        // Non modified or image file page (case 2).
                        //

                        MI_SET_PFN_DELETED (Pfn1);
                        ControlArea->NumberOfPfnReferences -= 1;
                        ASSERT ((LONG)ControlArea->NumberOfPfnReferences >= 0);

                        MiDecrementShareCount (Pfn1->PteFrame);

                        //
                        // Check the reference count for the page, if the reference
                        // count is zero and the page is not on the freelist,
                        // move the page to the free list, if the reference
                        // count is not zero, ignore this page.
                        // When the refernce count goes to zero, it will be placed on the
                        // free list.
                        //

                        if ((Pfn1->u3.e2.ReferenceCount == 0) &&
                             (Pfn1->u3.e1.PageLocation != FreePageList)) {

                            MiUnlinkPageFromList (Pfn1);
                            MiReleasePageFileSpace (Pfn1->OriginalPte);
                            MiInsertPageInList (MmPageLocationList[FreePageList],
                                            PteContents.u.Trans.PageFrameNumber);
                        }

                        PointerPte->u.Long = 0;

                        //
                        // If a cluster of pages to write has been completed,
                        // set the WriteNow flag.
                        //

                        if (LastWritten != NULL) {
                            WriteNow = TRUE;
                        }

                    } else {

                        //
                        // Check to see if this is the first page of a cluster.
                        //

                        if (LastWritten == NULL) {
                            LastPage = (PULONG)(Mdl + 1);
                            ASSERT (MiGetSubsectionAddress(&Pfn1->OriginalPte) ==
                                                                    Subsection);

                            //
                            // Calculate the offset to read into the file.
                            //  offset = base + ((thispte - basepte) << PAGE_SHIFT)
                            //

                            StartingOffset.QuadPart = MI_STARTING_OFFSET (
                                                             Subsection,
                                                             Pfn1->PteAddress);

                            MI_INITIALIZE_ZERO_MDL (Mdl);
                            Mdl->MdlFlags |= MDL_PAGES_LOCKED;

                            Mdl->StartVa =
                                   (PVOID)(Pfn1->u3.e1.PageColor << PAGE_SHIFT);
                            Mdl->Size = (CSHORT)(sizeof(MDL) +
                                       (sizeof(ULONG) * MmModifiedWriteClusterSize));
                        }

                        LastWritten = PointerPte;
                        Mdl->ByteCount += PAGE_SIZE;

                        //
                        // If the cluster is now full, set the write now flag.
                        //

                        if (Mdl->ByteCount == (PAGE_SIZE * MmModifiedWriteClusterSize)) {
                            WriteNow = TRUE;
                        }

                        MiUnlinkPageFromList (Pfn1);
                        Pfn1->u3.e1.Modified = 0;

                        //
                        // Up the reference count for the physical page as there
                        // is I/O in progress.
                        //

                        Pfn1->u3.e2.ReferenceCount += 1;

                        //
                        // Clear the modified bit for the page and set the write
                        // in progress bit.
                        //

                        *LastPage = PteContents.u.Trans.PageFrameNumber;

                        LastPage += 1;
                    }
                }
            } else {

                if (IS_PTE_NOT_DEMAND_ZERO (PteContents)) {
                    MiReleasePageFileSpace (PteContents);
                }
                PointerPte->u.Long = 0;

                //
                // If a cluster of pages to write has been completed,
                // set the WriteNow flag.
                //

                if (LastWritten != NULL) {
                    WriteNow = TRUE;
                }
            }
        } else {

            //
            // This is a normal prototype PTE in mapped file format.
            //

            if (LastWritten != NULL) {
                WriteNow = TRUE;
            }
        }

        //
        // Write the current cluster if it is complete,
        // full, or the loop is now complete.
        //

        PointerPte += 1;
        DelayCount = 0;

WriteItOut:

        if ((WriteNow) ||
            ((PointerPte == LastPte) && (LastWritten != NULL))) {

            //
            // Issue the write request.
            //

            UNLOCK_PFN (OldIrql);

            WriteNow = FALSE;

            KeClearEvent (IoEvent);

            //
            // Make sure the write does not go past the
            // end of file. (segment size).
            //

            TempOffset.QuadPart = ((LONGLONG)Subsection->EndingSector <<
                                        MMSECTOR_SHIFT) +
                            Subsection->u.SubsectionFlags.SectorEndOffset;

            if ((StartingOffset.QuadPart + Mdl->ByteCount) >
                         TempOffset.QuadPart) {

                ASSERT ((ULONG)(TempOffset.QuadPart -
                                    StartingOffset.QuadPart) >
                         (Mdl->ByteCount - PAGE_SIZE));

                Mdl->ByteCount = (ULONG)(TempOffset.QuadPart -
                                        StartingOffset.QuadPart);
            }

#if DBG
            if (MmDebug & MM_DBG_FLUSH_SECTION) {
                DbgPrint("MM:flush page write begun %lx\n",
                        Mdl->ByteCount);
            }
#endif //DBG

            Status = IoSynchronousPageWrite (
                                    ControlArea->FilePointer,
                                    Mdl,
                                    &StartingOffset,
                                    IoEvent,
                                    &IoStatus );

            if (NT_SUCCESS(Status)) {

                KeWaitForSingleObject( IoEvent,
                                       WrPageOut,
                                       KernelMode,
                                       FALSE,
                                       (PLARGE_INTEGER)NULL);
            }

            if (Mdl->MdlFlags & MDL_MAPPED_TO_SYSTEM_VA) {
                MmUnmapLockedPages (Mdl->MappedSystemVa, Mdl);
            }

            Page = (PULONG)(Mdl + 1);

            LOCK_PFN (OldIrql);

            if (((ULONG)PointerPte & (PAGE_SIZE - 1)) != 0) {

                //
                // The next PTE is not in a different page, make
                // sure this page did not leave memory when the
                // I/O was in progress.
                //

                MiMakeSystemAddressValidPfn (PointerPte);
            }

            //
            // I/O complete unlock pages.
            //
            // NOTE that the error status is ignored.
            //

            while (Page < LastPage) {

                Pfn2 = MI_PFN_ELEMENT (*Page);

                //
                // Make sure the page is still transition.
                //

                WrittenPte = Pfn2->PteAddress;

                MiDecrementReferenceCount (*Page);

                if (!MI_IS_PFN_DELETED (Pfn2)) {

                    //
                    // Make sure the prototype PTE is
                    // still in the working set.
                    //

                    MiMakeSystemAddressValidPfn (WrittenPte);

                    if (Pfn2->PteAddress != WrittenPte) {

                        //
                        // The PFN mutex was released to make the
                        // page table page valid, and while it
                        // was released, the phyiscal page
                        // was reused.  Go onto the next one.
                        //

                        Page += 1;
                        continue;
                    }

                    WrittenContents = *WrittenPte;

                    if ((WrittenContents.u.Soft.Prototype == 0) &&
                         (WrittenContents.u.Soft.Transition == 1)) {

                        MI_SET_PFN_DELETED (Pfn2);
                        ControlArea->NumberOfPfnReferences -= 1;
                        ASSERT ((LONG)ControlArea->NumberOfPfnReferences >= 0);

                        MiDecrementShareCount (Pfn2->PteFrame);

                        //
                        // Check the reference count for the page,
                        // if the reference count is zero and the
                        // page is not on the freelist, move the page
                        // to the free list, if the reference
                        // count is not zero, ignore this page.
                        // When the refernce count goes to zero,
                        // it will be placed on the free list.
                        //

                        if ((Pfn2->u3.e2.ReferenceCount == 0) &&
                           (Pfn2->u3.e1.PageLocation != FreePageList)) {

                            MiUnlinkPageFromList (Pfn2);
                            MiReleasePageFileSpace (Pfn2->OriginalPte);
                            MiInsertPageInList (
                                MmPageLocationList[FreePageList],
                                *Page);
                        }
                    }
                    WrittenPte->u.Long = 0;
                }
                Page += 1;
            }

            //
            // Indicate that there is no current cluster being built.
            //

            LastWritten = NULL;
        }

    } // end while

    //
    // Get the next subsection if any.
    //

    if (Subsection->NextSubsection == (PSUBSECTION)NULL) {
        break;
    }
    Subsection = Subsection->NextSubsection;
    PointerPte = Subsection->SubsectionBase;
    LastPte = PointerPte + Subsection->PtesInSubsection;


 } // end for

    ControlArea->NumberOfMappedViews = 0;

    ASSERT (ControlArea->NumberOfPfnReferences == 0);

    if (ControlArea->u.Flags.FilePointerNull == 0) {
        ControlArea->u.Flags.FilePointerNull = 1;
        if (ControlArea->u.Flags.Image) {
            ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject)) =
                                                        NULL;
        } else {
            ASSERT (((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) != NULL);
            ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) =
                                                        NULL;
        }
    }
    UNLOCK_PFN (OldIrql);

    ExFreePool (IoEvent);

    //
    // Delete the segment structure.
    //

    MiSegmentDelete (ControlArea->Segment);

    return;
}

NTSTATUS
MmGetFileNameForSection (
    IN HANDLE Section,
    OUT PSTRING FileName
    )

/*++

Routine Description:

    This function returns the file name for the corresponding section.

Arguments:

    Section - Supplies the handle of the section to get the name of.

    FileName - Returns the name of the corresonding section.

Return Value:

    TBS

Environment:

    Kernel mode, APC_LEVEL or below, no mutexes held.

--*/

{

    PSECTION SectionObject;
    POBJECT_NAME_INFORMATION FileNameInfo;
    ULONG whocares;
    NTSTATUS Status;
    ULONG Dereference;

    Dereference = TRUE;
#define xMAX_NAME 1024

    if ( (ULONG)Section & 1 ) {
        SectionObject = (PSECTION)((ULONG)Section & 0xfffffffe);
        Dereference = FALSE;
    } else {
        Status = ObReferenceObjectByHandle ( Section,
                                             0,
                                             MmSectionObjectType,
                                             KernelMode,
                                             (PVOID *)&SectionObject,
                                             NULL );

        if (!NT_SUCCESS(Status)) {
            return Status;
        }
    }
    if (SectionObject->u.Flags.Image == 0) {
        if ( Dereference ) ObDereferenceObject (SectionObject);
        return STATUS_SECTION_NOT_IMAGE;
    }

    FileNameInfo = ExAllocatePoolWithTag (PagedPool, xMAX_NAME, '  mM');
    if ( !FileNameInfo ) {
        if ( Dereference ) ObDereferenceObject (SectionObject);
        return STATUS_NO_MEMORY;
    }

    Status = ObQueryNameString(
                SectionObject->Segment->ControlArea->FilePointer,
                FileNameInfo,
                xMAX_NAME,
                &whocares
                );

    if ( Dereference ) ObDereferenceObject (SectionObject);
    if ( !NT_SUCCESS(Status) ) {
        ExFreePool(FileNameInfo);
        return Status;
        }

    FileName->Length = 0;
    FileName->MaximumLength = (FileNameInfo->Name.Length/sizeof(WCHAR)) + 1;
    FileName->Buffer = ExAllocatePoolWithTag (PagedPool,
                                              FileName->MaximumLength,
                                              '  mM');
    if ( !FileName->Buffer ) {
        ExFreePool(FileNameInfo);
        return STATUS_NO_MEMORY;
    }
    RtlUnicodeStringToAnsiString((PANSI_STRING)FileName,&FileNameInfo->Name,FALSE);
    FileName->Buffer[FileName->Length] = '\0';
    ExFreePool(FileNameInfo);

    return STATUS_SUCCESS;
}

VOID
MiCheckControlArea (
    IN PCONTROL_AREA ControlArea,
    IN PEPROCESS CurrentProcess,
    IN KIRQL PreviousIrql
    )

/*++

Routine Description:

    This routine checks the reference counts for the specified
    control area, and if the counts are all zero, it marks the
    control area for deletion and queues it to the deletion thread.


    *********************** NOTE ********************************
    This routine returns with the PFN LOCK RELEASED!!!!!

Arguments:

    ControlArea - Supplies a pointer to the control area to check.

    CurrentProcess - Supplies a pointer to the current process if and ONLY
                     IF the working set lock is held.

    PreviousIrql - Supplies the previous IRQL.

Return Value:

    NONE.

Environment:

    Kernel mode, PFN lock held, PFN lock release upon return!!!

--*/

{
    PEVENT_COUNTER PurgeEvent = NULL;
    ULONG DeleteOnClose = FALSE;
    ULONG DereferenceSegment = FALSE;


    MM_PFN_LOCK_ASSERT();
    if ((ControlArea->NumberOfMappedViews == 0) &&
         (ControlArea->NumberOfSectionReferences == 0)) {

        ASSERT (ControlArea->NumberOfUserReferences == 0);

        if (ControlArea->FilePointer != (PFILE_OBJECT)NULL) {

            if (ControlArea->NumberOfPfnReferences == 0) {

                //
                // There are no views and no physical pages referenced
                // by the Segment, derferenced the Segment object.
                //

                ControlArea->u.Flags.BeingDeleted = 1;
                DereferenceSegment = TRUE;

                ASSERT (ControlArea->u.Flags.FilePointerNull == 0);
                ControlArea->u.Flags.FilePointerNull = 1;
                if (ControlArea->u.Flags.Image) {
                    ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject)) =
                                                                    NULL;
                } else {
                    ASSERT (((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) != NULL);
                    ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) =
                                                                    NULL;
                }
            } else {

                //
                // Insert this segment into the unused segment list (unless
                // it is already on the list).
                //

                if (ControlArea->DereferenceList.Flink == NULL) {
                    InsertTailList ( &MmUnusedSegmentList,
                                     &ControlArea->DereferenceList);
                    MmUnusedSegmentCount += 1;
                }

                //
                // Indicate if this section should be deleted now that
                // the reference counts are zero.
                //

                DeleteOnClose = ControlArea->u.Flags.DeleteOnClose;

                //
                // The number of mapped views are zero, the number of
                // section references are zero, but there are some
                // pages of the file still resident.  If this is
                // an image with Global Memory, "purge" the subsections
                // which contian the global memory and reset them to
                // point back to the file.
                //

                if (ControlArea->u.Flags.GlobalMemory == 1) {
                    ASSERT (ControlArea->u.Flags.Image == 1);

                    ControlArea->u.Flags.BeingPurged = 1;
                    ControlArea->NumberOfMappedViews = 1;

                    MiPurgeImageSection (ControlArea, CurrentProcess);

                    ControlArea->u.Flags.BeingPurged = 0;
                    ControlArea->NumberOfMappedViews -= 1;
                    if ((ControlArea->NumberOfMappedViews == 0) &&
                        (ControlArea->NumberOfSectionReferences == 0) &&
                        (ControlArea->NumberOfPfnReferences == 0)) {

                        ControlArea->u.Flags.BeingDeleted = 1;
                        DereferenceSegment = TRUE;
                        ControlArea->u.Flags.FilePointerNull = 1;
                        ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject)) =
                                                                        NULL;
                    } else {

                        PurgeEvent = ControlArea->WaitingForDeletion;
                        ControlArea->WaitingForDeletion = NULL;
                    }
                }

                //
                // If delete on close is set and the segment was
                // not deleted, up the count of mapped views so the
                // control area will not be deleted when the PFN lock
                // is released.
                //

                if (DeleteOnClose && !DereferenceSegment) {
                    ControlArea->NumberOfMappedViews = 1;
                    ControlArea->u.Flags.BeingDeleted = 1;
                }
            }

        } else {

            //
            // This Segment is backed by a paging file, dereference the
            // Segment object when the number of views goes from 1 to 0
            // without regard to the number of PFN references.
            //

            ControlArea->u.Flags.BeingDeleted = 1;
            DereferenceSegment = TRUE;
        }
    }

    UNLOCK_PFN (PreviousIrql);

    if (DereferenceSegment || DeleteOnClose) {

        //
        // Release the working set mutex, if it is held as the object
        // management routines may page fault, ect..
        //

        if (CurrentProcess) {
            UNLOCK_WS (CurrentProcess);
        }

        if (DereferenceSegment) {

            //
            // Delete the segment.
            //

            MiSegmentDelete (ControlArea->Segment);

        } else {

            //
            // The segment should be forced closed now.
            //

            MiCleanSection (ControlArea);
        }

        ASSERT (PurgeEvent == NULL);

        //
        // Reaquire the working set lock, if a process was specified.
        //

        if (CurrentProcess) {
            LOCK_WS (CurrentProcess);
        }

    } else {

        //
        // If any threads are waiting for the segment, indicate the
        // the purge operation has completed.
        //

        if (PurgeEvent != NULL) {
            KeSetEvent (&PurgeEvent->Event, 0, FALSE);
        }

        if (MmUnusedSegmentCount > (MmUnusedSegmentCountMaximum << 2)) {
            KeSetEvent (&MmUnusedSegmentCleanup, 0, FALSE);
        }
    }

    return;
}

VOID
MiCheckForControlAreaDeletion (
    IN PCONTROL_AREA ControlArea
    )

/*++

Routine Description:

    This routine checks the reference counts for the specified
    control area, and if the counts are all zero, it marks the
    control area for deletion and queues it to the deletion thread.

Arguments:

    ControlArea - Supplies a pointer to the control area to check.

    CurrentProcess - Supplies a pointer to the current process IF
                     the working set lock is held.  If the working
                     set lock is NOT HELD, this value is NULL.

Return Value:

    None.

Environment:

    Kernel mode, PFN lock held.

--*/

{
    KIRQL OldIrql;

    MM_PFN_LOCK_ASSERT();
    if ((ControlArea->NumberOfPfnReferences == 0) &&
        (ControlArea->NumberOfMappedViews == 0) &&
        (ControlArea->NumberOfSectionReferences == 0 )) {

        //
        // This segment is no longer mapped in any address space
        // nor are there any prototype PTEs within the segment
        // which are valid or in a transition state.  Queue
        // the segment to the segment-dereferencer thread
        // which will dereference the segment object, potentially
        // causing the segment to be deleted.
        //

        ControlArea->u.Flags.BeingDeleted = 1;
        ASSERT (ControlArea->u.Flags.FilePointerNull == 0);
        ControlArea->u.Flags.FilePointerNull = 1;

        if (ControlArea->u.Flags.Image) {
            ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject)) =
                                                            NULL;
        } else {
            ((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) =
                                                            NULL;
        }

        ExAcquireSpinLock (&MmDereferenceSegmentHeader.Lock, &OldIrql);

        ASSERT (ControlArea->DereferenceList.Flink != NULL);

        //
        // Remove the entry from the unused segment list and put
        // on the dereference list.
        //

        RemoveEntryList (&ControlArea->DereferenceList);
        MmUnusedSegmentCount -= 1;
        InsertTailList (&MmDereferenceSegmentHeader.ListHead,
                        &ControlArea->DereferenceList);
        ExReleaseSpinLock (&MmDereferenceSegmentHeader.Lock, OldIrql);

        KeReleaseSemaphore (&MmDereferenceSegmentHeader.Semaphore,
                            0L,
                            1L,
                            FALSE);
    }
    return;
}


ULONG
MiCheckControlAreaStatus (
    IN SECTION_CHECK_TYPE SectionCheckType,
    IN PSECTION_OBJECT_POINTERS SectionObjectPointers,
    IN ULONG DelayClose,
    OUT PCONTROL_AREA *ControlAreaOut,
    OUT PKIRQL PreviousIrql
    )

/*++

Routine Description:

    This routine checks the status of the control area for the specified
    SectionObjectPointers.  If the control area is in use, that is, the
    number of section references and the number of mapped views are not
    both zero, no action is taken and the function returns FALSE.

    If there is no control area associated with the specified
    SectionObjectPointers or the control area is in the process of being
    created or deleted, no action is taken and the value TRUE is returned.

    If, there are no section objects and the control area is not being
    created or deleted, the address of the control area is returned
    in the ControlArea argument, the address of a pool block to free
    is returned in the SegmentEventOut argument and the PFN_LOCK is
    still held at the return.

Arguments:

    *SegmentEventOut - Returns a pointer to NonPaged Pool which much be
                       freed by the caller when the PFN_LOCK is released.
                       This value is NULL if no pool is allocated and the
                       PFN_LOCK is not held.

    SecionCheckType - Supplies the type of section to check on, one of
                      CheckImageSection, CheckDataSection, CheckBothSection.

    SectionObjectPointers - Supplies the section object pointers through
                            which the control area can be located.

    DelayClose - Supplies a boolean which if TRUE and the control area
                 is being used, the delay on close field should be set
                 in the control area.

    *ControlAreaOut - Returns the addresss of the control area.

    PreviousIrql - Returns, in the case the PFN_LOCK is held, the previous
                   IRQL so the lock can be released properly.

Return Value:

    FALSE if the control area is in use, TRUE if the control area is gone or
    in the process or being created or deleted.

Environment:

    Kernel mode, PFN lock NOT held.

--*/


{
    PEVENT_COUNTER IoEvent;
    PEVENT_COUNTER SegmentEvent;
    ULONG DeallocateSegmentEvent = TRUE;
    PCONTROL_AREA ControlArea;
    ULONG SectRef;
    KIRQL OldIrql;

    //
    // Allocate an event to wait on in case the segment is in the
    // process of being deleted.  This event cannot be allocated
    // with the PFN database locked as pool expansion would deadlock.
    //

    *ControlAreaOut = NULL;

    //
    // Acquire the PFN mutex and examine the section object pointer
    // value within the file object.
    //

    //
    // File control blocks live in non-paged pool.
    //

    LOCK_PFN (OldIrql);

    SegmentEvent = MiGetEventCounter ();

    if (SectionCheckType != CheckImageSection) {
        ControlArea = ((PCONTROL_AREA)(SectionObjectPointers->DataSectionObject));
    } else {
        ControlArea = ((PCONTROL_AREA)(SectionObjectPointers->ImageSectionObject));
    }

    if (ControlArea == NULL) {

        if (SectionCheckType != CheckBothSection) {

            //
            // This file no longer has an associated segment.
            //

            MiFreeEventCounter (SegmentEvent, TRUE);
            UNLOCK_PFN (OldIrql);
            return TRUE;
        } else {
            ControlArea = ((PCONTROL_AREA)(SectionObjectPointers->ImageSectionObject));
            if (ControlArea == NULL) {

                //
                // This file no longer has an associated segment.
                //

                MiFreeEventCounter (SegmentEvent, TRUE);
                UNLOCK_PFN (OldIrql);
                return TRUE;
            }
        }
    }

    //
    //  Depending on the type of section, check for the pertinant
    //  reference count being non-zero.
    //

    if (SectionCheckType != CheckUserDataSection) {
        SectRef = ControlArea->NumberOfSectionReferences;
    } else {
        SectRef = ControlArea->NumberOfUserReferences;
    }

    if ((SectRef != 0) ||
        (ControlArea->NumberOfMappedViews != 0) ||
        (ControlArea->u.Flags.BeingCreated)) {


        //
        // The segment is currently in use or being created.
        //

        if (DelayClose) {

            //
            // The section should be deleted when the reference
            // counts are zero, set the delete on close flag.
            //

            ControlArea->u.Flags.DeleteOnClose = 1;
        }

        MiFreeEventCounter (SegmentEvent, TRUE);
        UNLOCK_PFN (OldIrql);
        return FALSE;
    }

    //
    // The segment has no references, delete it.  If the segment
    // is already being deleted, set the event field in the control
    // area and wait on the event.
    //

    if (ControlArea->u.Flags.BeingDeleted) {

        //
        // The segment object is in the process of being deleted.
        // Check to see if another thread is waiting for the deletion,
        // otherwise create and event object to wait upon.
        //

        if (ControlArea->WaitingForDeletion == NULL) {

            //
            // Create an event a put it's address in the control area.
            //

            DeallocateSegmentEvent = FALSE;
            ControlArea->WaitingForDeletion = SegmentEvent;
            IoEvent = SegmentEvent;
        } else {
            IoEvent = ControlArea->WaitingForDeletion;
            IoEvent->RefCount += 1;
        }

        //
        // Release the mutex and wait for the event.
        //

        KeEnterCriticalRegion();
        UNLOCK_PFN_AND_THEN_WAIT(OldIrql);

        KeWaitForSingleObject(&IoEvent->Event,
                              WrPageOut,
                              KernelMode,
                              FALSE,
                              (PLARGE_INTEGER)NULL);
        KeLeaveCriticalRegion();

        LOCK_PFN (OldIrql);
        MiFreeEventCounter (IoEvent, TRUE);
        if (DeallocateSegmentEvent) {
            MiFreeEventCounter (SegmentEvent, TRUE);
        }
        UNLOCK_PFN (OldIrql);
        return TRUE;
    }

    //
    // Return with the PFN database locked.
    //

    MiFreeEventCounter (SegmentEvent, FALSE);
    *ControlAreaOut = ControlArea;
    *PreviousIrql = OldIrql;
    return FALSE;
}


PEVENT_COUNTER
MiGetEventCounter (
    )

/*++

Routine Description:

    This function maintains a list of "events" to allow waiting
    on segment operations (deletion, creation, purging).

Arguments:

    None.

Return Value:

    Event to be used for waiting (stored into the control area).

Environment:

    Kernel mode, PFN lock held.

--*/

{
    KIRQL OldIrql;
    PEVENT_COUNTER Support;
    PLIST_ENTRY NextEntry;

    MM_PFN_LOCK_ASSERT();

    if (MmEventCountList.Count == 0) {
        ASSERT (IsListEmpty(&MmEventCountList.ListHead));
        OldIrql = APC_LEVEL;
        UNLOCK_PFN (OldIrql);
        Support = ExAllocatePoolWithTag (NonPagedPoolMustSucceed,
                                         sizeof(EVENT_COUNTER),
                                         'xEmM');
        KeInitializeEvent (&Support->Event, NotificationEvent, FALSE);
        LOCK_PFN (OldIrql);
    } else {
        ASSERT (!IsListEmpty(&MmEventCountList.ListHead));
        MmEventCountList.Count -= 1;
        NextEntry = RemoveHeadList (&MmEventCountList.ListHead);
        Support = CONTAINING_RECORD (NextEntry,
                                     EVENT_COUNTER,
                                     ListEntry );
        //ASSERT (Support->RefCount == 0);
        KeClearEvent (&Support->Event);
    }
    Support->RefCount = 1;
    Support->ListEntry.Flink = NULL;
    return Support;
}


VOID
MiFreeEventCounter (
    IN PEVENT_COUNTER Support,
    IN ULONG Flush
    )

/*++

Routine Description:

    This routine frees an event counter back to the free list.

Arguments:

    Support - Supplies a pointer to the event counter.

    Flush - Supplies TRUE if the PFN lock can be released and the event
            counter pool block actually freed.  The PFN lock will be
            reacquired before returning.

Return Value:

    None.

Environment:

    Kernel mode, PFN lock held.

--*/

{

    MM_PFN_LOCK_ASSERT();

    ASSERT (Support->RefCount != 0);
    ASSERT (Support->ListEntry.Flink == NULL);
    Support->RefCount -= 1;
    if (Support->RefCount == 0) {
        InsertTailList (&MmEventCountList.ListHead,
                        &Support->ListEntry);
        MmEventCountList.Count += 1;
    }
    if ((Flush) && (MmEventCountList.Count > 4)) {
        MiFlushEventCounter();
    }
    return;
}


VOID
MiFlushEventCounter (
    )

/*++

Routine Description:

    This routine examines the list of event counters and attempts
    to free up to 10 (if there are more than 4).

    It will release and reacquire the PFN lock when it frees the
    event counters!

Arguments:

    None.

Return Value:

    None.

Environment:

    Kernel mode, PFN lock held.

--*/


{
    KIRQL OldIrql;
    PEVENT_COUNTER Support[10];
    ULONG i = 0;
    PLIST_ENTRY NextEntry;

    MM_PFN_LOCK_ASSERT();

    while ((MmEventCountList.Count > 4) && (i < 10)) {
        NextEntry = RemoveHeadList (&MmEventCountList.ListHead);
        Support[i] = CONTAINING_RECORD (NextEntry,
                                        EVENT_COUNTER,
                                        ListEntry );
        Support[i]->ListEntry.Flink = NULL;
        i += 1;
        MmEventCountList.Count -= 1;
    }

    if (i == 0) {
        return;
    }

    OldIrql = APC_LEVEL;
    UNLOCK_PFN (OldIrql);

    do {
        i -= 1;
        ExFreePool(Support[i]);
    } while (i > 0);

    LOCK_PFN (OldIrql);

    return;
}


BOOLEAN
MmCanFileBeTruncated (
    IN PSECTION_OBJECT_POINTERS SectionPointer,
    IN PLARGE_INTEGER NewFileSize
    )

/*++

Routine Description:

    This routine does the following:

        1.  Checks to see if a image section is in use for the file,
            if so it returns FALSE.

        2.  Checks to see if a user section exists for the file, if
            it does, it checks to make sure the new file size is greater
            than the size of the file, if not it returns FALSE.

        3.  If no image section exists, and no user created data section
            exists or the files size is greater, then TRUE is returned.

Arguments:

    SectionPointer - Supplies a pointer to the section object pointers
                     from the file object.

    NewFileSize - Supplies a pointer to the size the file is getting set to.

Return Value:

    TRUE if the file can be truncated, FALSE if it cannot be.

Environment:

    Kernel mode.

--*/

{
    LARGE_INTEGER LocalOffset;
    KIRQL OldIrql;

    //
    //  Capture caller's file size, since we may modify it.
    //

    if (ARGUMENT_PRESENT(NewFileSize)) {

        LocalOffset = *NewFileSize;
        NewFileSize = &LocalOffset;
    }

    if (MmCanFileBeTruncatedInternal( SectionPointer, NewFileSize, &OldIrql )) {

        UNLOCK_PFN (OldIrql);
        return TRUE;
    }

    return FALSE;
}

ULONG
MmCanFileBeTruncatedInternal (
    IN PSECTION_OBJECT_POINTERS SectionPointer,
    IN PLARGE_INTEGER NewFileSize OPTIONAL,
    OUT PKIRQL PreviousIrql
    )

/*++

Routine Description:

    This routine does the following:

        1.  Checks to see if a image section is in use for the file,
            if so it returns FALSE.

        2.  Checks to see if a user section exists for the file, if
            it does, it checks to make sure the new file size is greater
            than the size of the file, if not it returns FALSE.

        3.  If no image section exists, and no user created data section
            exists or the files size is greater, then TRUE is returned.

Arguments:

    SectionPointer - Supplies a pointer to the section object pointers
                     from the file object.

    NewFileSize - Supplies a pointer to the size the file is getting set to.

    PreviousIrql - If returning TRUE, returns Irql to use when unlocking
                   Pfn database.

Return Value:

    TRUE if the file can be truncated (PFN locked).
    FALSE if it cannot be truncated (PFN not locked).

Environment:

    Kernel mode.

--*/

{
    KIRQL OldIrql;
    LARGE_INTEGER SegmentSize;
    PCONTROL_AREA ControlArea;
    PSUBSECTION Subsection;

    if (!MmFlushImageSection (SectionPointer, MmFlushForWrite)) {
        return FALSE;
    }

    LOCK_PFN (OldIrql);

    ControlArea = (PCONTROL_AREA)(SectionPointer->DataSectionObject);

    if (ControlArea != NULL) {

        if (ControlArea->u.Flags.BeingCreated) {
            goto UnlockAndReturn;
        }

        //
        // If there are user references and the size is less than the
        // size of the user view, don't allow the trucation.
        //

        if (ControlArea->NumberOfUserReferences != 0) {

            //
            //  You cannot purge the entire section if there is a user
            //  reference.
            //

            if (!ARGUMENT_PRESENT(NewFileSize)) {
                goto UnlockAndReturn;
            }

            //
            // Locate last subsection and get total size.
            //

            Subsection = (PSUBSECTION)(ControlArea + 1);
            while (Subsection->NextSubsection != NULL) {
                Subsection = Subsection->NextSubsection;
            }

            SegmentSize.QuadPart =
                    ((LONGLONG)Subsection->EndingSector << MMSECTOR_SHIFT) +
                        Subsection->u.SubsectionFlags.SectorEndOffset;

            if (NewFileSize->QuadPart < SegmentSize.QuadPart) {
                goto UnlockAndReturn;
            }

            //
            //  If there are mapped views, we will skip the last page
            //  of the section if the size passed in falls in that page.
            //  The caller (like Cc) may want to clear this fractional page.
            //

            SegmentSize.QuadPart += PAGE_SIZE - 1;
            SegmentSize.LowPart &= ~(PAGE_SIZE - 1);
            if (NewFileSize->QuadPart < SegmentSize.QuadPart) {
                *NewFileSize = SegmentSize;
            }
        }
    }

    *PreviousIrql = OldIrql;
    return TRUE;

UnlockAndReturn:
    UNLOCK_PFN (OldIrql);
    return FALSE;
}


VOID
MiRemoveUnusedSegments (
    VOID
    )

/*++

Routine Description:

    This routine removes unused segments (no section refernces,
    no mapped views only PFN references that are in transition state).

Arguments:

    None.

Return Value:

    None.

Environment:

    Kernel mode.

--*/

{
    KIRQL OldIrql;
    PLIST_ENTRY NextEntry;
    PCONTROL_AREA ControlArea;
    NTSTATUS Status;

    while (MmUnusedSegmentCount > MmUnusedSegmentCountGoal) {

        //
        // Eliminate some of the unused segments which are only
        // kept in memory because they contain transition pages.
        //

        Status = STATUS_SUCCESS;

        LOCK_PFN (OldIrql);

        if (IsListEmpty(&MmUnusedSegmentList)) {

            //
            // There is nothing in the list, rewait.
            //

            ASSERT (MmUnusedSegmentCount == 0);
            UNLOCK_PFN (OldIrql);
            break;
        }

        NextEntry = RemoveHeadList(&MmUnusedSegmentList);
        MmUnusedSegmentCount -= 1;

        ControlArea = CONTAINING_RECORD( NextEntry,
                                         CONTROL_AREA,
                                         DereferenceList );
#if DBG
        if (MmDebug & MM_DBG_SECTIONS) {
            DbgPrint("MM: cleaning segment %lx control %lx\n",
                ControlArea->Segment, ControlArea);
        }
#endif

        //
        // Indicate this entry is not on any list.
        //

#if DBG
        if (ControlArea->u.Flags.BeingDeleted == 0) {
          if (ControlArea->u.Flags.Image) {
            ASSERT (((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->ImageSectionObject)) != NULL);
          } else {
            ASSERT (((PCONTROL_AREA)(ControlArea->FilePointer->SectionObjectPointer->DataSectionObject)) != NULL);
          }
        }
#endif //DBG

        //
        // Set the flink to NULL indicating this control area
        // is not on any lists.
        //

        ControlArea->DereferenceList.Flink = NULL;

        if ((ControlArea->NumberOfMappedViews == 0) &&
            (ControlArea->NumberOfSectionReferences == 0) &&
            (ControlArea->u.Flags.BeingDeleted == 0)) {

            //
            // If there is paging I/O in progress on this
            // segment, just put this at the tail of the list, as
            // the call to MiCleanSegment would block waiting
            // for the I/O to complete.  As this could tie up
            // the thread, don't do it.
            //

            if (ControlArea->ModifiedWriteCount > 0) {
                InsertTailList ( &MmUnusedSegmentList,
                                 &ControlArea->DereferenceList);
                MmUnusedSegmentCount += 1;
                UNLOCK_PFN (OldIrql);
                continue;
            }

            //
            // Up the number of mapped views to prevent other threads
            // from freeing this.
            //

            ControlArea->NumberOfMappedViews = 1;
            UNLOCK_PFN (OldIrql);
            {
                PSUBSECTION Subsection;
                PSUBSECTION LastSubsection;
                PMMPTE PointerPte;
                PMMPTE LastPte;
                IO_STATUS_BLOCK IoStatus;

                Subsection = (PSUBSECTION)(ControlArea + 1);
                PointerPte = &Subsection->SubsectionBase[0];
                LastSubsection = Subsection;
                while (LastSubsection->NextSubsection != NULL) {
                    LastSubsection = LastSubsection->NextSubsection;
                }
                LastPte = &LastSubsection->SubsectionBase
                                    [LastSubsection->PtesInSubsection - 1];

                //
                //  Preacquire the file to prevent deadlocks with other flushers
                //

                FsRtlAcquireFileForCcFlush (ControlArea->FilePointer);

                Status = MiFlushSectionInternal (PointerPte,
                                                 LastPte,
                                                 Subsection,
                                                 LastSubsection,
                                                 FALSE,
                                                 &IoStatus);
                //
                //  Now release the file
                //

                FsRtlReleaseFileForCcFlush (ControlArea->FilePointer);
            }

            LOCK_PFN (OldIrql);

            if (!NT_SUCCESS(Status)) {
                if ((Status == STATUS_FILE_LOCK_CONFLICT) ||
                    (ControlArea->u.Flags.Networked == 0)) {

                    //
                    // If an error occurs, don't flush this section, unless
                    // it's a networked file and the status is not
                    // LOCK_CONFLICT.
                    //

                    ControlArea->NumberOfMappedViews -= 1;
                    UNLOCK_PFN (OldIrql);
                    continue;
                }
            }

            if (!((ControlArea->NumberOfMappedViews == 1) &&
                (ControlArea->NumberOfSectionReferences == 0) &&
                (ControlArea->u.Flags.BeingDeleted == 0))) {
                ControlArea->NumberOfMappedViews -= 1;
                UNLOCK_PFN (OldIrql);
                continue;
            }

            ControlArea->u.Flags.BeingDeleted = 1;

            //
            // Don't let any pages be written by the modified
            // page writer from this point on.
            //

            ControlArea->u.Flags.NoModifiedWriting = 1;
            ASSERT (ControlArea->u.Flags.FilePointerNull == 0);
            UNLOCK_PFN (OldIrql);
            MiCleanSection (ControlArea);
        } else {

            //
            // The segment was not eligible for deletion.  Just
            // leave it off the unused segment list and continue the
            // loop.
            //

            UNLOCK_PFN (OldIrql);
        }

    } //end while
    return;
}