sync with trunk head (34904)
[reactos.git] / reactos / ntoskrnl / mm / anonmem.c
index 0c92ce6..dd1943c 100644 (file)
@@ -1,52 +1,61 @@
 /*
- *  ReactOS kernel
- *  Copyright (C) 1998, 1999, 2000, 2001, 2002 ReactOS Team
+ * Copyright (C) 2002-2005 ReactOS Team (and the authors from the programmers section)
  *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
  *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-/* $Id: anonmem.c,v 1.29 2004/07/10 17:01:03 hbirr Exp $
  *
- * PROJECT:     ReactOS kernel
- * FILE:        ntoskrnl/mm/anonmem.c
- * PURPOSE:     Implementing anonymous memory.
- * PROGRAMMER:  David Welch
+ * PROJECT:         ReactOS kernel
+ * FILE:            ntoskrnl/mm/anonmem.c
+ * PURPOSE:         Implementing anonymous memory.
+ *
+ * PROGRAMMERS:     David Welch
+ *                  Casper Hornstrup
+ *                  KJK::Hyperion
+ *                  Ge van Geldorp
+ *                  Eric Kohl
+ *                  Royce Mitchell III
+ *                  Aleksey Bragin
+ *                  Jason Filby
+ *                  Art Yerkes
+ *                  Gunnar Andre' Dalsnes
+ *                  Filip Navara
+ *                  Thomas Weidenmueller
+ *                  Alex Ionescu
+ *                  Trevor McCort
+ *                  Steven Edwards
  */
 
 /* INCLUDE *****************************************************************/
 
-#include <ddk/ntddk.h>
-#include <internal/mm.h>
-#include <internal/ob.h>
-#include <internal/io.h>
-#include <internal/ps.h>
-#include <internal/pool.h>
-
+#include <ntoskrnl.h>
 #define NDEBUG
 #include <internal/debug.h>
 
 /* FUNCTIONS *****************************************************************/
 
 NTSTATUS
-MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
+NTAPI
+MmWritePageVirtualMemory(PMM_AVL_TABLE AddressSpace,
                          PMEMORY_AREA MemoryArea,
                          PVOID Address,
                          PMM_PAGEOP PageOp)
 {
    SWAPENTRY SwapEntry;
-   LARGE_INTEGER PhysicalAddress;
+   PFN_TYPE Page;
    NTSTATUS Status;
+   PEPROCESS Process = MmGetAddressSpaceOwner(AddressSpace);
 
    /*
     * Check for paging out from a deleted virtual memory area.
@@ -59,13 +68,12 @@ MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
       return(STATUS_UNSUCCESSFUL);
    }
 
-   PhysicalAddress =
-      MmGetPhysicalAddressForProcess(AddressSpace->Process, Address);
+   Page = MmGetPfnForProcess(Process, Address);
 
    /*
     * Get that the page actually is dirty.
     */
-   if (!MmIsDirtyPage(MemoryArea->Process, Address))
+   if (!MmIsDirtyPage(Process, Address))
    {
       PageOp->Status = STATUS_SUCCESS;
       KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
@@ -76,18 +84,18 @@ MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Speculatively set the mapping to clean.
     */
-   MmSetCleanPage(MemoryArea->Process, Address);
+   MmSetCleanPage(Process, Address);
 
    /*
     * If necessary, allocate an entry in the paging file for this page
     */
-   SwapEntry = MmGetSavedSwapEntryPage(PhysicalAddress);
+   SwapEntry = MmGetSavedSwapEntryPage(Page);
    if (SwapEntry == 0)
    {
       SwapEntry = MmAllocSwapPage();
       if (SwapEntry == 0)
       {
-         MmSetDirtyPage(MemoryArea->Process, Address);
+         MmSetDirtyPage(Process, Address);
          PageOp->Status = STATUS_PAGEFILE_QUOTA_EXCEEDED;
          KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
          MmReleasePageOp(PageOp);
@@ -98,12 +106,12 @@ MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Write the page to the pagefile
     */
-   Status = MmWriteToSwapPage(SwapEntry, &PhysicalAddress);
+   Status = MmWriteToSwapPage(SwapEntry, Page);
    if (!NT_SUCCESS(Status))
    {
       DPRINT1("MM: Failed to write to swap page (Status was 0x%.8X)\n",
               Status);
-      MmSetDirtyPage(MemoryArea->Process, Address);
+      MmSetDirtyPage(Process, Address);
       PageOp->Status = STATUS_UNSUCCESSFUL;
       KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
       MmReleasePageOp(PageOp);
@@ -113,7 +121,7 @@ MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Otherwise we have succeeded.
     */
-   MmSetSavedSwapEntryPage(PhysicalAddress, SwapEntry);
+   MmSetSavedSwapEntryPage(Page, SwapEntry);
    PageOp->Status = STATUS_SUCCESS;
    KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
    MmReleasePageOp(PageOp);
@@ -121,18 +129,20 @@ MmWritePageVirtualMemory(PMADDRESS_SPACE AddressSpace,
 }
 
 NTSTATUS
-MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
+NTAPI
+MmPageOutVirtualMemory(PMM_AVL_TABLE AddressSpace,
                        PMEMORY_AREA MemoryArea,
                        PVOID Address,
                        PMM_PAGEOP PageOp)
 {
-   PHYSICAL_ADDRESS PhysicalAddress;
-   BOOL WasDirty;
+   PFN_TYPE Page;
+   BOOLEAN WasDirty;
    SWAPENTRY SwapEntry;
    NTSTATUS Status;
-
+   PEPROCESS Process = MmGetAddressSpaceOwner(AddressSpace);
+    
    DPRINT("MmPageOutVirtualMemory(Address 0x%.8X) PID %d\n",
-          Address, MemoryArea->Process->UniqueProcessId);
+          Address, Process->UniqueProcessId);
 
    /*
     * Check for paging out from a deleted virtual memory area.
@@ -148,27 +158,29 @@ MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Disable the virtual mapping.
     */
-   MmDisableVirtualMapping(MemoryArea->Process, Address,
-                           &WasDirty, &PhysicalAddress);
+   MmDisableVirtualMapping(Process, Address,
+                           &WasDirty, &Page);
 
-   if (PhysicalAddress.QuadPart == 0)
+   if (Page == 0)
    {
       KEBUGCHECK(0);
    }
 
    /*
-    * Paging out non-dirty data is easy. 
+    * Paging out non-dirty data is easy.
     */
    if (!WasDirty)
    {
-      MmDeleteVirtualMapping(MemoryArea->Process, Address, FALSE, NULL, NULL);
-      MmDeleteAllRmaps(PhysicalAddress, NULL, NULL);
-      if ((SwapEntry = MmGetSavedSwapEntryPage(PhysicalAddress)) != 0)
+      MmLockAddressSpace(AddressSpace);
+      MmDeleteVirtualMapping(Process, Address, FALSE, NULL, NULL);
+      MmDeleteAllRmaps(Page, NULL, NULL);
+      if ((SwapEntry = MmGetSavedSwapEntryPage(Page)) != 0)
       {
-         MmCreatePageFileMapping(MemoryArea->Process, Address, SwapEntry);
-         MmSetSavedSwapEntryPage(PhysicalAddress, 0);
+         MmCreatePageFileMapping(Process, Address, SwapEntry);
+         MmSetSavedSwapEntryPage(Page, 0);
       }
-      MmReleasePageMemoryConsumer(MC_USER, PhysicalAddress);
+      MmUnlockAddressSpace(AddressSpace);
+      MmReleasePageMemoryConsumer(MC_USER, Page);
       PageOp->Status = STATUS_SUCCESS;
       KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
       MmReleasePageOp(PageOp);
@@ -178,14 +190,14 @@ MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * If necessary, allocate an entry in the paging file for this page
     */
-   SwapEntry = MmGetSavedSwapEntryPage(PhysicalAddress);
+   SwapEntry = MmGetSavedSwapEntryPage(Page);
    if (SwapEntry == 0)
    {
       SwapEntry = MmAllocSwapPage();
       if (SwapEntry == 0)
       {
          MmShowOutOfSpaceMessagePagingFile();
-         MmEnableVirtualMapping(MemoryArea->Process, Address);
+         MmEnableVirtualMapping(Process, Address);
          PageOp->Status = STATUS_UNSUCCESSFUL;
          KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
          MmReleasePageOp(PageOp);
@@ -196,12 +208,12 @@ MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Write the page to the pagefile
     */
-   Status = MmWriteToSwapPage(SwapEntry, &PhysicalAddress);
+   Status = MmWriteToSwapPage(SwapEntry, Page);
    if (!NT_SUCCESS(Status))
    {
       DPRINT1("MM: Failed to write to swap page (Status was 0x%.8X)\n",
               Status);
-      MmEnableVirtualMapping(MemoryArea->Process, Address);
+      MmEnableVirtualMapping(Process, Address);
       PageOp->Status = STATUS_UNSUCCESSFUL;
       KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
       MmReleasePageOp(PageOp);
@@ -211,12 +223,14 @@ MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Otherwise we have succeeded, free the page
     */
-   DPRINT("MM: Swapped out virtual memory page 0x%.8X!\n", PhysicalAddress);
-   MmDeleteVirtualMapping(MemoryArea->Process, Address, FALSE, NULL, NULL);
-   MmCreatePageFileMapping(MemoryArea->Process, Address, SwapEntry);
-   MmDeleteAllRmaps(PhysicalAddress, NULL, NULL);
-   MmSetSavedSwapEntryPage(PhysicalAddress, 0);
-   MmReleasePageMemoryConsumer(MC_USER, PhysicalAddress);
+   DPRINT("MM: Swapped out virtual memory page 0x%.8X!\n", Page << PAGE_SHIFT);
+   MmLockAddressSpace(AddressSpace);
+   MmDeleteVirtualMapping(Process, Address, FALSE, NULL, NULL);
+   MmCreatePageFileMapping(Process, Address, SwapEntry);
+   MmUnlockAddressSpace(AddressSpace);
+   MmDeleteAllRmaps(Page, NULL, NULL);
+   MmSetSavedSwapEntryPage(Page, 0);
+   MmReleasePageMemoryConsumer(MC_USER, Page);
    PageOp->Status = STATUS_SUCCESS;
    KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
    MmReleasePageOp(PageOp);
@@ -224,7 +238,8 @@ MmPageOutVirtualMemory(PMADDRESS_SPACE AddressSpace,
 }
 
 NTSTATUS
-MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
+NTAPI
+MmNotPresentFaultVirtualMemory(PMM_AVL_TABLE AddressSpace,
                                MEMORY_AREA* MemoryArea,
                                PVOID Address,
                                BOOLEAN Locked)
@@ -238,11 +253,12 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
  * NOTES: This function is called with the address space lock held.
  */
 {
-   PHYSICAL_ADDRESS Page;
+   PFN_TYPE Page;
    NTSTATUS Status;
    PMM_REGION Region;
    PMM_PAGEOP PageOp;
-
+   PEPROCESS Process = MmGetAddressSpaceOwner(AddressSpace);
+    
    /*
     * There is a window between taking the page fault and locking the
     * address space when another thread could load the page so we check
@@ -252,7 +268,7 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    {
       if (Locked)
       {
-         MmLockPage(MmGetPhysicalAddressForProcess(NULL, Address));
+         MmLockPage(MmGetPfnForProcess(NULL, Address));
       }
       return(STATUS_SUCCESS);
    }
@@ -268,7 +284,7 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Get the segment corresponding to the virtual address
     */
-   Region = MmFindRegion(MemoryArea->BaseAddress,
+   Region = MmFindRegion(MemoryArea->StartingAddress,
                          &MemoryArea->Data.VirtualMemoryData.RegionListHead,
                          Address, NULL);
    if (Region->Type == MEM_RESERVE || Region->Protect == PAGE_NOACCESS)
@@ -279,7 +295,7 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Get or create a page operation
     */
-   PageOp = MmGetPageOp(MemoryArea, (ULONG)MemoryArea->Process->UniqueProcessId,
+   PageOp = MmGetPageOp(MemoryArea, Process->UniqueProcessId,
                         (PVOID)PAGE_ROUND_DOWN(Address), NULL, 0,
                         MM_PAGEOP_PAGEIN, FALSE);
    if (PageOp == NULL)
@@ -337,7 +353,7 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
       MmLockAddressSpace(AddressSpace);
       if (Locked)
       {
-         MmLockPage(MmGetPhysicalAddressForProcess(NULL, Address));
+         MmLockPage(MmGetPfnForProcess(NULL, Address));
       }
       KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
       MmReleasePageOp(PageOp);
@@ -367,8 +383,8 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    {
       SWAPENTRY SwapEntry;
 
-      MmDeletePageFileMapping(MemoryArea->Process, Address, &SwapEntry);
-      Status = MmReadFromSwapPage(SwapEntry, &Page);
+      MmDeletePageFileMapping(Process, Address, &SwapEntry);
+      Status = MmReadFromSwapPage(SwapEntry, Page);
       if (!NT_SUCCESS(Status))
       {
          KEBUGCHECK(0);
@@ -380,19 +396,19 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
     * Set the page. If we fail because we are out of memory then
     * try again
     */
-   Status = MmCreateVirtualMapping(MemoryArea->Process,
+   Status = MmCreateVirtualMapping(Process,
                                    (PVOID)PAGE_ROUND_DOWN(Address),
                                    Region->Protect,
-                                   Page,
-                                   FALSE);
+                                   &Page,
+                                   1);
    while (Status == STATUS_NO_MEMORY)
    {
       MmUnlockAddressSpace(AddressSpace);
-      Status = MmCreateVirtualMapping(MemoryArea->Process,
+      Status = MmCreateVirtualMapping(Process,
                                       Address,
                                       Region->Protect,
-                                      Page,
-                                      TRUE);
+                                      &Page,
+                                      1);
       MmLockAddressSpace(AddressSpace);
    }
    if (!NT_SUCCESS(Status))
@@ -405,14 +421,14 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    /*
     * Add the page to the process's working set
     */
-   MmInsertRmap(Page, MemoryArea->Process, (PVOID)PAGE_ROUND_DOWN(Address));
+   MmInsertRmap(Page, Process, (PVOID)PAGE_ROUND_DOWN(Address));
 
    /*
     * Finish the operation
     */
    if (Locked)
    {
-      MmLockPage(MmGetPhysicalAddressForProcess(NULL, Address));
+      MmLockPage(Page);
    }
    PageOp->Status = STATUS_SUCCESS;
    KeSetEvent(&PageOp->CompletionEvent, IO_NO_INCREMENT, FALSE);
@@ -420,8 +436,8 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
    return(STATUS_SUCCESS);
 }
 
-VOID STATIC
-MmModifyAttributes(PMADDRESS_SPACE AddressSpace,
+VOID static
+MmModifyAttributes(PMM_AVL_TABLE AddressSpace,
                    PVOID BaseAddress,
                    ULONG RegionSize,
                    ULONG OldType,
@@ -432,6 +448,8 @@ MmModifyAttributes(PMADDRESS_SPACE AddressSpace,
  * FUNCTION: Modify the attributes of a memory region
  */
 {
+   PEPROCESS Process = MmGetAddressSpaceOwner(AddressSpace);
+    
    /*
     * If we are switching a previously committed region to reserved then
     * free any allocated pages within the region
@@ -442,35 +460,35 @@ MmModifyAttributes(PMADDRESS_SPACE AddressSpace,
 
       for (i=0; i < PAGE_ROUND_UP(RegionSize)/PAGE_SIZE; i++)
       {
-         LARGE_INTEGER PhysicalAddr;
+         PFN_TYPE Page;
 
-         if (MmIsPageSwapEntry(AddressSpace->Process,
+         if (MmIsPageSwapEntry(Process,
                                (char*)BaseAddress + (i * PAGE_SIZE)))
          {
             SWAPENTRY SwapEntry;
 
-            MmDeletePageFileMapping(AddressSpace->Process,
+            MmDeletePageFileMapping(Process,
                                     (char*)BaseAddress + (i * PAGE_SIZE),
                                     &SwapEntry);
             MmFreeSwapPage(SwapEntry);
          }
          else
          {
-            MmDeleteVirtualMapping(AddressSpace->Process,
+            MmDeleteVirtualMapping(Process,
                                    (char*)BaseAddress + (i*PAGE_SIZE),
-                                   FALSE, NULL, &PhysicalAddr);
-            if (PhysicalAddr.QuadPart != 0)
+                                   FALSE, NULL, &Page);
+            if (Page != 0)
             {
                SWAPENTRY SavedSwapEntry;
-               SavedSwapEntry = MmGetSavedSwapEntryPage(PhysicalAddr);
+               SavedSwapEntry = MmGetSavedSwapEntryPage(Page);
                if (SavedSwapEntry != 0)
                {
                   MmFreeSwapPage(SavedSwapEntry);
-                  MmSetSavedSwapEntryPage(PhysicalAddr, 0);
+                  MmSetSavedSwapEntryPage(Page, 0);
                }
-               MmDeleteRmap(PhysicalAddr, AddressSpace->Process,
+               MmDeleteRmap(Page, Process,
                             (char*)BaseAddress + (i * PAGE_SIZE));
-               MmReleasePageMemoryConsumer(MC_USER, PhysicalAddr);
+               MmReleasePageMemoryConsumer(MC_USER, Page);
             }
          }
       }
@@ -481,16 +499,16 @@ MmModifyAttributes(PMADDRESS_SPACE AddressSpace,
     * alter the attributes for any allocated pages within the region
     */
    if (NewType == MEM_COMMIT && OldType == MEM_COMMIT &&
-         OldProtect != NewProtect)
+       OldProtect != NewProtect)
    {
       ULONG i;
 
       for (i=0; i < PAGE_ROUND_UP(RegionSize)/PAGE_SIZE; i++)
       {
-         if (MmIsPagePresent(AddressSpace->Process,
+         if (MmIsPagePresent(Process,
                              (char*)BaseAddress + (i*PAGE_SIZE)))
          {
-            MmSetPageProtect(AddressSpace->Process,
+            MmSetPageProtect(Process,
                              (char*)BaseAddress + (i*PAGE_SIZE),
                              NewProtect);
          }
@@ -502,74 +520,179 @@ MmModifyAttributes(PMADDRESS_SPACE AddressSpace,
  * @implemented
  */
 NTSTATUS STDCALL
-NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
-                        IN OUT PVOID*  UBaseAddress,
-                        IN ULONG ZeroBits,
-                        IN OUT PULONG URegionSize,
-                        IN ULONG AllocationType,
-                        IN ULONG Protect)
+NtAllocateVirtualMemory(IN     HANDLE ProcessHandle,
+                        IN OUT PVOID* UBaseAddress,
+                        IN     ULONG  ZeroBits,
+                        IN OUT PSIZE_T URegionSize,
+                        IN     ULONG  AllocationType,
+                        IN     ULONG  Protect)
 /*
  * FUNCTION: Allocates a block of virtual memory in the process address space
  * ARGUMENTS:
  *      ProcessHandle = The handle of the process which owns the virtual memory
- *      BaseAddress   = A pointer to the virtual memory allocated. If you 
- *                      supply a non zero value the system will try to 
- *                      allocate the memory at the address supplied. It round 
+ *      BaseAddress   = A pointer to the virtual memory allocated. If you
+ *                      supply a non zero value the system will try to
+ *                      allocate the memory at the address supplied. It round
  *                      it down to a multiple  of the page size.
- *      ZeroBits  = (OPTIONAL) You can specify the number of high order bits 
- *                      that must be zero, ensuring that the memory will be 
+ *      ZeroBits  = (OPTIONAL) You can specify the number of high order bits
+ *                      that must be zero, ensuring that the memory will be
  *                      allocated at a address below a certain value.
  *      RegionSize = The number of bytes to allocate
- *      AllocationType = Indicates the type of virtual memory you like to 
- *                       allocated, can be a combination of MEM_COMMIT, 
+ *      AllocationType = Indicates the type of virtual memory you like to
+ *                       allocated, can be a combination of MEM_COMMIT,
  *                       MEM_RESERVE, MEM_RESET, MEM_TOP_DOWN.
  *      Protect = Indicates the protection type of the pages allocated, can be
- *                a combination of PAGE_READONLY, PAGE_READWRITE, 
- *                PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_GUARD, 
+ *                a combination of PAGE_READONLY, PAGE_READWRITE,
+ *                PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE, PAGE_GUARD,
  *                PAGE_NOACCESS
  * RETURNS: Status
  */
 {
    PEPROCESS Process;
    MEMORY_AREA* MemoryArea;
+   ULONG_PTR MemoryAreaLength;
    ULONG Type;
    NTSTATUS Status;
-   PMADDRESS_SPACE AddressSpace;
+   PMM_AVL_TABLE AddressSpace;
    PVOID BaseAddress;
    ULONG RegionSize;
    PVOID PBaseAddress;
    ULONG PRegionSize;
    PHYSICAL_ADDRESS BoundaryAddressMultiple;
+   KPROCESSOR_MODE PreviousMode;
+
+   PAGED_CODE();
 
    DPRINT("NtAllocateVirtualMemory(*UBaseAddress %x, "
           "ZeroBits %d, *URegionSize %x, AllocationType %x, Protect %x)\n",
           *UBaseAddress,ZeroBits,*URegionSize,AllocationType,
           Protect);
 
-   /*
-    * Check the validity of the parameters
-    */
+   /* Check for valid protection flags */
    if ((Protect & PAGE_FLAGS_VALID_FROM_USER_MODE) != Protect)
    {
-      return(STATUS_INVALID_PAGE_PROTECTION);
+      DPRINT1("Invalid page protection\n");
+      return STATUS_INVALID_PAGE_PROTECTION;
+   }
+
+   /* Check for valid Zero bits */
+   if (ZeroBits > 21)
+   {
+      DPRINT1("Too many zero bits\n");
+      return STATUS_INVALID_PARAMETER_3;
+   }
+
+   /* Check for valid Allocation Types */
+   if ((AllocationType & ~(MEM_COMMIT | MEM_RESERVE | MEM_RESET | MEM_PHYSICAL |
+                           MEM_TOP_DOWN | MEM_WRITE_WATCH)))
+   {
+      DPRINT1("Invalid Allocation Type\n");
+      return STATUS_INVALID_PARAMETER_5;
+   }
+
+   /* Check for at least one of these Allocation Types to be set */
+   if (!(AllocationType & (MEM_COMMIT | MEM_RESERVE | MEM_RESET)))
+   {
+      DPRINT1("No memory allocation base type\n");
+      return STATUS_INVALID_PARAMETER_5;
+   }
+
+   /* MEM_RESET is an exclusive flag, make sure that is valid too */
+   if ((AllocationType & MEM_RESET) && (AllocationType != MEM_RESET))
+   {
+      DPRINT1("Invalid use of MEM_RESET\n");
+      return STATUS_INVALID_PARAMETER_5;
+   }
+
+   /* MEM_WRITE_WATCH can only be used if MEM_RESERVE is also used */
+   if ((AllocationType & MEM_WRITE_WATCH) && !(AllocationType & MEM_RESERVE))
+   {
+      DPRINT1("MEM_WRITE_WATCH used without MEM_RESERVE\n");
+      return STATUS_INVALID_PARAMETER_5;
    }
-   if ((AllocationType & (MEM_COMMIT | MEM_RESERVE)) == 0)
+
+   /* MEM_PHYSICAL can only be used with MEM_RESERVE, and can only be R/W */
+   if (AllocationType & MEM_PHYSICAL)
+   {
+      /* First check for MEM_RESERVE exclusivity */
+      if (AllocationType != (MEM_RESERVE | MEM_PHYSICAL))
+      {
+         DPRINT1("MEM_PHYSICAL used with other flags then MEM_RESERVE or"
+                 "MEM_RESERVE was not present at all\n");
+         return STATUS_INVALID_PARAMETER_5;
+      }
+
+      /* Then make sure PAGE_READWRITE is used */
+      if (Protect != PAGE_READWRITE)
+      {
+         DPRINT1("MEM_PHYSICAL used without PAGE_READWRITE\n");
+         return STATUS_INVALID_PAGE_PROTECTION;
+      }
+   }
+
+   PreviousMode = KeGetPreviousMode();
+
+   _SEH_TRY
+   {
+      if (PreviousMode != KernelMode)
+      {
+         ProbeForWritePointer(UBaseAddress);
+         ProbeForWriteUlong(URegionSize);
+      }
+      PBaseAddress = *UBaseAddress;
+      PRegionSize  = *URegionSize;
+   }
+   _SEH_HANDLE
    {
-      return(STATUS_INVALID_PARAMETER);
+      /* Get the exception code */
+      Status = _SEH_GetExceptionCode();
+      _SEH_YIELD(return Status);
    }
+   _SEH_END;
 
-   PBaseAddress = *UBaseAddress;
-   PRegionSize = *URegionSize;
    BoundaryAddressMultiple.QuadPart = 0;
 
    BaseAddress = (PVOID)PAGE_ROUND_DOWN(PBaseAddress);
-   RegionSize = PAGE_ROUND_UP(PBaseAddress + PRegionSize) -
+   RegionSize = PAGE_ROUND_UP((ULONG_PTR)PBaseAddress + PRegionSize) -
                 PAGE_ROUND_DOWN(PBaseAddress);
 
+   /*
+    * We've captured and calculated the data, now do more checks
+    * Yes, MmCreateMemoryArea does similar checks, but they don't return
+    * the right status codes that a caller of this routine would expect.
+    */
+   if ((ULONG_PTR)BaseAddress >= USER_SHARED_DATA)
+   {
+      DPRINT1("Virtual allocation base above User Space\n");
+      return STATUS_INVALID_PARAMETER_2;
+   }
+   if (!RegionSize)
+   {
+      DPRINT1("Region size is invalid (zero)\n");
+      return STATUS_INVALID_PARAMETER_4;
+   }
+   if ((USER_SHARED_DATA - (ULONG_PTR)BaseAddress) < RegionSize)
+   {
+      DPRINT1("Region size would overflow into kernel-memory\n");
+      return STATUS_INVALID_PARAMETER_4;
+   }
+
+   /*
+    * Copy on Write is reserved for system use. This case is a certain failure
+    * but there may be other cases...needs more testing
+    */
+   if ((!BaseAddress || (AllocationType & MEM_RESERVE)) &&
+       (Protect & (PAGE_WRITECOPY | PAGE_EXECUTE_WRITECOPY)))
+   {
+      DPRINT1("Copy on write is not supported by VirtualAlloc\n");
+      return STATUS_INVALID_PAGE_PROTECTION;
+   }
+
+
    Status = ObReferenceObjectByHandle(ProcessHandle,
                                       PROCESS_VM_OPERATION,
-                                      NULL,
-                                      UserMode,
+                                      PsProcessType,
+                                      PreviousMode,
                                       (PVOID*)(&Process),
                                       NULL);
    if (!NT_SUCCESS(Status))
@@ -581,59 +704,70 @@ NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
    Type = (AllocationType & MEM_COMMIT) ? MEM_COMMIT : MEM_RESERVE;
    DPRINT("Type %x\n", Type);
 
-   AddressSpace = &Process->AddressSpace;
+   AddressSpace = &Process->VadRoot;
    MmLockAddressSpace(AddressSpace);
 
    if (PBaseAddress != 0)
    {
-      MemoryArea = MmOpenMemoryAreaByAddress(AddressSpace,
-                                             BaseAddress);
+      MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace, BaseAddress);
 
-      if (MemoryArea != NULL &&
-            MemoryArea->Type == MEMORY_AREA_VIRTUAL_MEMORY &&
-            MemoryArea->Length >= RegionSize)
-      {
-         Status =
-            MmAlterRegion(AddressSpace,
-                          MemoryArea->BaseAddress,
-                          &MemoryArea->Data.VirtualMemoryData.RegionListHead,
-                          BaseAddress, RegionSize,
-                          Type, Protect, MmModifyAttributes);
-         MmUnlockAddressSpace(AddressSpace);
-         ObDereferenceObject(Process);
-         DPRINT("NtAllocateVirtualMemory() = %x\n",Status);
-         return(Status);
-      }
-      else if (MemoryArea != NULL && MemoryArea->Length >= RegionSize)
-      {
-         Status =
-            MmAlterRegion(AddressSpace,
-                          MemoryArea->BaseAddress,
-                          &MemoryArea->Data.SectionData.RegionListHead,
-                          BaseAddress, RegionSize,
-                          Type, Protect, MmModifyAttributes);
-         MmUnlockAddressSpace(AddressSpace);
-         ObDereferenceObject(Process);
-         DPRINT("NtAllocateVirtualMemory() = %x\n",Status);
-         return(Status);
-      }
-      else if (MemoryArea != NULL)
+      if (MemoryArea != NULL)
       {
-         MmUnlockAddressSpace(AddressSpace);
-         ObDereferenceObject(Process);
-         return(STATUS_UNSUCCESSFUL);
+         MemoryAreaLength = (ULONG_PTR)MemoryArea->EndingAddress -
+                            (ULONG_PTR)MemoryArea->StartingAddress;
+         if (MemoryArea->Type == MEMORY_AREA_VIRTUAL_MEMORY &&
+             MemoryAreaLength >= RegionSize)
+         {
+            Status =
+               MmAlterRegion(AddressSpace,
+                             MemoryArea->StartingAddress,
+                             &MemoryArea->Data.VirtualMemoryData.RegionListHead,
+                             BaseAddress, RegionSize,
+                             Type, Protect, MmModifyAttributes);
+            MmUnlockAddressSpace(AddressSpace);
+            ObDereferenceObject(Process);
+            DPRINT("NtAllocateVirtualMemory() = %x\n",Status);
+            return(Status);
+         }
+         else if (MemoryAreaLength >= RegionSize)
+         {
+            /* Region list initialized? */
+            if (MemoryArea->Data.SectionData.RegionListHead.Flink)
+            {
+               Status =
+                  MmAlterRegion(AddressSpace,
+                                MemoryArea->StartingAddress,
+                                &MemoryArea->Data.SectionData.RegionListHead,
+                                BaseAddress, RegionSize,
+                                Type, Protect, MmModifyAttributes);
+            }
+            else
+            {
+               Status = STATUS_ACCESS_VIOLATION;
+            }
+
+            MmUnlockAddressSpace(AddressSpace);
+            ObDereferenceObject(Process);
+            DPRINT("NtAllocateVirtualMemory() = %x\n",Status);
+            return(Status);
+         }
+         else
+         {
+            MmUnlockAddressSpace(AddressSpace);
+            ObDereferenceObject(Process);
+            return(STATUS_UNSUCCESSFUL);
+         }
       }
    }
 
-   Status = MmCreateMemoryArea(Process,
-                               AddressSpace,
+   Status = MmCreateMemoryArea(AddressSpace,
                                MEMORY_AREA_VIRTUAL_MEMORY,
                                &BaseAddress,
                                RegionSize,
                                Protect,
                                &MemoryArea,
                                PBaseAddress != 0,
-                               (AllocationType & MEM_TOP_DOWN),
+                               AllocationType & MEM_TOP_DOWN,
                                BoundaryAddressMultiple);
    if (!NT_SUCCESS(Status))
    {
@@ -642,18 +776,22 @@ NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
       DPRINT("NtAllocateVirtualMemory() = %x\n",Status);
       return(Status);
    }
-   MmInitialiseRegion(&MemoryArea->Data.VirtualMemoryData.RegionListHead,
-                      RegionSize, Type, Protect);
+
+   MemoryAreaLength = (ULONG_PTR)MemoryArea->EndingAddress -
+                      (ULONG_PTR)MemoryArea->StartingAddress;
+
+   MmInitializeRegion(&MemoryArea->Data.VirtualMemoryData.RegionListHead,
+                      MemoryAreaLength, Type, Protect);
 
    if ((AllocationType & MEM_COMMIT) &&
-         ((Protect & PAGE_READWRITE) ||
-          (Protect & PAGE_EXECUTE_READWRITE)))
+       (Protect & (PAGE_READWRITE | PAGE_EXECUTE_READWRITE)))
    {
-      MmReserveSwapPages(RegionSize);
+      const ULONG nPages = PAGE_ROUND_UP(MemoryAreaLength) >> PAGE_SHIFT;
+      MmReserveSwapPages(nPages);
    }
 
    *UBaseAddress = BaseAddress;
-   *URegionSize = RegionSize;
+   *URegionSize = MemoryAreaLength;
    DPRINT("*UBaseAddress %x  *URegionSize %x\n", BaseAddress, RegionSize);
 
    MmUnlockAddressSpace(AddressSpace);
@@ -661,27 +799,27 @@ NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
    return(STATUS_SUCCESS);
 }
 
-VOID STATIC
+VOID static
 MmFreeVirtualMemoryPage(PVOID Context,
                         MEMORY_AREA* MemoryArea,
                         PVOID Address,
-                        PHYSICAL_ADDRESS PhysicalAddr,
+                        PFN_TYPE Page,
                         SWAPENTRY SwapEntry,
                         BOOLEAN Dirty)
 {
    PEPROCESS Process = (PEPROCESS)Context;
 
-   if (PhysicalAddr.QuadPart != 0)
+   if (Page != 0)
    {
       SWAPENTRY SavedSwapEntry;
-      SavedSwapEntry = MmGetSavedSwapEntryPage(PhysicalAddr);
+      SavedSwapEntry = MmGetSavedSwapEntryPage(Page);
       if (SavedSwapEntry != 0)
       {
          MmFreeSwapPage(SavedSwapEntry);
-         MmSetSavedSwapEntryPage(PhysicalAddr, 0);
+         MmSetSavedSwapEntryPage(Page, 0);
       }
-      MmDeleteRmap(PhysicalAddr, Process, Address);
-      MmReleasePageMemoryConsumer(MC_USER, PhysicalAddr);
+      MmDeleteRmap(Page, Process, Address);
+      MmReleasePageMemoryConsumer(MC_USER, Page);
    }
    else if (SwapEntry != 0)
    {
@@ -690,6 +828,7 @@ MmFreeVirtualMemoryPage(PVOID Context,
 }
 
 VOID
+NTAPI
 MmFreeVirtualMemory(PEPROCESS Process,
                     PMEMORY_AREA MemoryArea)
 {
@@ -709,22 +848,20 @@ MmFreeVirtualMemory(PEPROCESS Process,
     */
    if (MemoryArea->PageOpCount > 0)
    {
-      for (i = 0; i < PAGE_ROUND_UP(MemoryArea->Length) / PAGE_SIZE; i++)
+      ULONG_PTR MemoryAreaLength = (ULONG_PTR)MemoryArea->EndingAddress -
+                                   (ULONG_PTR)MemoryArea->StartingAddress;
+      const ULONG nPages = PAGE_ROUND_UP(MemoryAreaLength) >> PAGE_SHIFT;
+
+      for (i = 0; i < nPages && MemoryArea->PageOpCount != 0; ++i)
       {
          PMM_PAGEOP PageOp;
-
-         if (MemoryArea->PageOpCount == 0)
-         {
-            break;
-         }
-
          PageOp = MmCheckForPageOp(MemoryArea, Process->UniqueProcessId,
-                                   (char*)MemoryArea->BaseAddress + (i * PAGE_SIZE),
+                                   (PVOID)((ULONG_PTR)MemoryArea->StartingAddress + (i * PAGE_SIZE)),
                                    NULL, 0);
          if (PageOp != NULL)
          {
             NTSTATUS Status;
-            MmUnlockAddressSpace(&Process->AddressSpace);
+            MmUnlockAddressSpace(&Process->VadRoot);
             Status = KeWaitForSingleObject(&PageOp->CompletionEvent,
                                            0,
                                            KernelMode,
@@ -735,7 +872,7 @@ MmFreeVirtualMemory(PEPROCESS Process,
                DPRINT1("Failed to wait for page op\n");
                KEBUGCHECK(0);
             }
-            MmLockAddressSpace(&Process->AddressSpace);
+            MmLockAddressSpace(&Process->VadRoot);
             MmReleasePageOp(PageOp);
          }
       }
@@ -751,38 +888,37 @@ MmFreeVirtualMemory(PEPROCESS Process,
    }
 
    /* Actually free the memory area. */
-   MmFreeMemoryArea(&Process->AddressSpace,
-                    MemoryArea->BaseAddress,
-                    0,
+   MmFreeMemoryArea(&Process->VadRoot,
+                    MemoryArea,
                     MmFreeVirtualMemoryPage,
                     (PVOID)Process);
 }
 
 /*
- * @unimplemented
+ * @implemented
  */
 NTSTATUS STDCALL
 NtFreeVirtualMemory(IN HANDLE ProcessHandle,
                     IN PVOID*  PBaseAddress,
-                    IN PULONG PRegionSize,
+                    IN PSIZE_T PRegionSize,
                     IN ULONG FreeType)
 /*
  * FUNCTION: Frees a range of virtual memory
  * ARGUMENTS:
- *        ProcessHandle = Points to the process that allocated the virtual 
+ *        ProcessHandle = Points to the process that allocated the virtual
  *                        memory
- *        BaseAddress = Points to the memory address, rounded down to a 
+ *        BaseAddress = Points to the memory address, rounded down to a
  *                      multiple of the pagesize
- *        RegionSize = Limits the range to free, rounded up to a multiple of 
+ *        RegionSize = Limits the range to free, rounded up to a multiple of
  *                     the paging size
  *        FreeType = Can be one of the values:  MEM_DECOMMIT, or MEM_RELEASE
- * RETURNS: Status 
+ * RETURNS: Status
  */
 {
    MEMORY_AREA* MemoryArea;
    NTSTATUS Status;
    PEPROCESS Process;
-   PMADDRESS_SPACE AddressSpace;
+   PMM_AVL_TABLE AddressSpace;
    PVOID BaseAddress;
    ULONG RegionSize;
 
@@ -791,7 +927,7 @@ NtFreeVirtualMemory(IN HANDLE ProcessHandle,
           *PRegionSize,FreeType);
 
    BaseAddress = (PVOID)PAGE_ROUND_DOWN((*PBaseAddress));
-   RegionSize = PAGE_ROUND_UP((*PBaseAddress) + (*PRegionSize)) -
+   RegionSize = PAGE_ROUND_UP((ULONG_PTR)(*PBaseAddress) + (*PRegionSize)) -
                 PAGE_ROUND_DOWN((*PBaseAddress));
 
    Status = ObReferenceObjectByHandle(ProcessHandle,
@@ -805,54 +941,57 @@ NtFreeVirtualMemory(IN HANDLE ProcessHandle,
       return(Status);
    }
 
-   AddressSpace = &Process->AddressSpace;
+   AddressSpace = &Process->VadRoot;
 
    MmLockAddressSpace(AddressSpace);
-   MemoryArea = MmOpenMemoryAreaByAddress(AddressSpace,
-                                          BaseAddress);
+   MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace, BaseAddress);
    if (MemoryArea == NULL)
    {
-      MmUnlockAddressSpace(AddressSpace);
-      ObDereferenceObject(Process);
-      return(STATUS_UNSUCCESSFUL);
+      Status = STATUS_UNSUCCESSFUL;
+      goto unlock_deref_and_return;
    }
 
    switch (FreeType)
    {
       case MEM_RELEASE:
          /* We can only free a memory area in one step. */
-         if (MemoryArea->BaseAddress != BaseAddress)
+         if (MemoryArea->StartingAddress != BaseAddress ||
+             MemoryArea->Type != MEMORY_AREA_VIRTUAL_MEMORY)
          {
-            MmUnlockAddressSpace(AddressSpace);
-            ObDereferenceObject(Process);
-            return(STATUS_UNSUCCESSFUL);
+            Status = STATUS_UNSUCCESSFUL;
+            goto unlock_deref_and_return;
          }
+
          MmFreeVirtualMemory(Process, MemoryArea);
-         MmUnlockAddressSpace(AddressSpace);
-         ObDereferenceObject(Process);
-         return(STATUS_SUCCESS);
+         Status = STATUS_SUCCESS;
+         goto unlock_deref_and_return;
 
       case MEM_DECOMMIT:
          Status =
             MmAlterRegion(AddressSpace,
-                          MemoryArea->BaseAddress,
+                          MemoryArea->StartingAddress,
                           &MemoryArea->Data.VirtualMemoryData.RegionListHead,
                           BaseAddress,
                           RegionSize,
                           MEM_RESERVE,
                           PAGE_NOACCESS,
                           MmModifyAttributes);
-         MmUnlockAddressSpace(AddressSpace);
-         ObDereferenceObject(Process);
-         return(Status);
+         goto unlock_deref_and_return;
    }
+
+   Status = STATUS_NOT_IMPLEMENTED;
+
+unlock_deref_and_return:
+
    MmUnlockAddressSpace(AddressSpace);
    ObDereferenceObject(Process);
-   return(STATUS_NOT_IMPLEMENTED);
+
+   return(Status);
 }
 
 NTSTATUS
-MmProtectAnonMem(PMADDRESS_SPACE AddressSpace,
+NTAPI
+MmProtectAnonMem(PMM_AVL_TABLE AddressSpace,
                  PMEMORY_AREA MemoryArea,
                  PVOID BaseAddress,
                  ULONG Length,
@@ -862,11 +1001,11 @@ MmProtectAnonMem(PMADDRESS_SPACE AddressSpace,
    PMM_REGION Region;
    NTSTATUS Status;
 
-   Region = MmFindRegion(MemoryArea->BaseAddress,
+   Region = MmFindRegion(MemoryArea->StartingAddress,
                          &MemoryArea->Data.VirtualMemoryData.RegionListHead,
                          BaseAddress, NULL);
    *OldProtect = Region->Protect;
-   Status = MmAlterRegion(AddressSpace, MemoryArea->BaseAddress,
+   Status = MmAlterRegion(AddressSpace, MemoryArea->StartingAddress,
                           &MemoryArea->Data.VirtualMemoryData.RegionListHead,
                           BaseAddress, Length, Region->Type, Protect,
                           MmModifyAttributes);
@@ -880,17 +1019,17 @@ MmQueryAnonMem(PMEMORY_AREA MemoryArea,
                PULONG ResultLength)
 {
    PMM_REGION Region;
-   PVOID RegionBase;
+   PVOID RegionBase = NULL;
 
    Info->BaseAddress = (PVOID)PAGE_ROUND_DOWN(Address);
 
-   Region = MmFindRegion(MemoryArea->BaseAddress,
+   Region = MmFindRegion(MemoryArea->StartingAddress,
                          &MemoryArea->Data.VirtualMemoryData.RegionListHead,
                          Address, &RegionBase);
    Info->BaseAddress = RegionBase;
-   Info->AllocationBase = MemoryArea->BaseAddress;
-   Info->AllocationProtect = MemoryArea->Attributes;
-   Info->RegionSize = (char*)RegionBase + Region->Length - (char*)Info->BaseAddress;
+   Info->AllocationBase = MemoryArea->StartingAddress;
+   Info->AllocationProtect = MemoryArea->Protect;
+   Info->RegionSize = Region->Length;
    Info->State = Region->Type;
    Info->Protect = Region->Protect;
    Info->Type = MEM_PRIVATE;