diff --git a/ntoskrnl/cc/copy.c b/ntoskrnl/cc/copy.c index c39b214..a70e0ab 100644 --- a/ntoskrnl/cc/copy.c +++ b/ntoskrnl/cc/copy.c @@ -110,6 +110,7 @@ CcReadVirtualAddress ( _SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER) { Status = _SEH2_GetExceptionCode(); + DPRINT1("MmProbeAndLockPages failed with: %lx for %p (%p, %p)\n", Status, Mdl, Vacb, Vacb->BaseAddress); KeBugCheck(CACHE_MANAGER); } _SEH2_END; @@ -186,6 +187,7 @@ CcWriteVirtualAddress ( _SEH2_EXCEPT (EXCEPTION_EXECUTE_HANDLER) { Status = _SEH2_GetExceptionCode(); + DPRINT1("MmProbeAndLockPages failed with: %lx for %p (%p, %p)\n", Status, Mdl, Vacb, Vacb->BaseAddress); KeBugCheck(CACHE_MANAGER); } _SEH2_END; diff --git a/ntoskrnl/cc/fs.c b/ntoskrnl/cc/fs.c index 2ab7b5f..cb98eed 100644 --- a/ntoskrnl/cc/fs.c +++ b/ntoskrnl/cc/fs.c @@ -238,6 +238,7 @@ CcPurgeCacheSection ( /* This VACB is in range, so unlink it and mark for free */ ASSERT(Refs == 1 || Vacb->Dirty); RemoveEntryList(&Vacb->VacbLruListEntry); + InitializeListHead(&Vacb->VacbLruListEntry); if (Vacb->Dirty) { CcRosUnmarkDirtyVacb(Vacb, FALSE); @@ -250,11 +251,14 @@ CcPurgeCacheSection ( while (!IsListEmpty(&FreeList)) { + ULONG Refs; + Vacb = CONTAINING_RECORD(RemoveHeadList(&FreeList), ROS_VACB, CacheMapVacbListEntry); - CcRosVacbDecRefCount(Vacb); - CcRosInternalFreeVacb(Vacb); + InitializeListHead(&Vacb->CacheMapVacbListEntry); + Refs = CcRosVacbDecRefCount(Vacb); + ASSERT(Refs == 0); } return Success; diff --git a/ntoskrnl/cc/pin.c b/ntoskrnl/cc/pin.c index c916783..d81f09d 100644 --- a/ntoskrnl/cc/pin.c +++ b/ntoskrnl/cc/pin.c @@ -215,7 +215,6 @@ CcPinRead ( iBcb->Pinned = TRUE; iBcb->Vacb->PinCount++; - CcRosReleaseVacbLock(iBcb->Vacb); if (Flags & PIN_EXCLUSIVE) { @@ -308,7 +307,6 @@ CcUnpinDataForThread ( { ExReleaseResourceForThreadLite(&iBcb->Lock, ResourceThreadId); iBcb->Pinned = FALSE; - CcRosAcquireVacbLock(iBcb->Vacb, NULL); iBcb->Vacb->PinCount--; } @@ -360,7 +358,6 @@ CcUnpinRepinnedBcb ( IoStatus->Information = 0; if (WriteThrough) { - CcRosAcquireVacbLock(iBcb->Vacb, NULL); if (iBcb->Vacb->Dirty) { IoStatus->Status = CcRosFlushVacb(iBcb->Vacb); @@ -369,7 +366,6 @@ CcUnpinRepinnedBcb ( { IoStatus->Status = STATUS_SUCCESS; } - CcRosReleaseVacbLock(iBcb->Vacb); } else { @@ -380,7 +376,6 @@ CcUnpinRepinnedBcb ( { ExReleaseResourceLite(&iBcb->Lock); iBcb->Pinned = FALSE; - CcRosAcquireVacbLock(iBcb->Vacb, NULL); iBcb->Vacb->PinCount--; ASSERT(iBcb->Vacb->PinCount == 0); } diff --git a/ntoskrnl/cc/view.c b/ntoskrnl/cc/view.c index ba87c5e..bf8c2a8 100644 --- a/ntoskrnl/cc/view.c +++ b/ntoskrnl/cc/view.c @@ -90,6 +90,11 @@ ULONG CcRosVacbDecRefCount_(PROS_VACB vacb, PCSTR file, INT line) file, line, vacb, Refs, vacb->Dirty, vacb->PageOut); } + if (Refs == 0) + { + CcRosInternalFreeVacb(vacb); + } + return Refs; } ULONG CcRosVacbGetRefCount_(PROS_VACB vacb, PCSTR file, INT line) @@ -107,9 +112,6 @@ ULONG CcRosVacbGetRefCount_(PROS_VACB vacb, PCSTR file, INT line) } #endif -NTSTATUS -CcRosInternalFreeVacb(PROS_VACB Vacb); - /* FUNCTIONS *****************************************************************/ @@ -187,12 +189,10 @@ CcRosFlushDirtyPages ( PROS_VACB current; BOOLEAN Locked; NTSTATUS Status; - LARGE_INTEGER ZeroTimeout; DPRINT("CcRosFlushDirtyPages(Target %lu)\n", Target); (*Count) = 0; - ZeroTimeout.QuadPart = 0; KeEnterCriticalRegion(); KeAcquireGuardedMutex(&ViewLock); @@ -228,22 +228,11 @@ CcRosFlushDirtyPages ( continue; } - Status = CcRosAcquireVacbLock(current, - Wait ? NULL : &ZeroTimeout); - if (Status != STATUS_SUCCESS) - { - current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite( - current->SharedCacheMap->LazyWriteContext); - CcRosVacbDecRefCount(current); - continue; - } - ASSERT(current->Dirty); /* One reference is added above */ if (CcRosVacbGetRefCount(current) > 2) { - CcRosReleaseVacbLock(current); current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite( current->SharedCacheMap->LazyWriteContext); CcRosVacbDecRefCount(current); @@ -254,7 +243,6 @@ CcRosFlushDirtyPages ( Status = CcRosFlushVacb(current); - CcRosReleaseVacbLock(current); current->SharedCacheMap->Callbacks->ReleaseFromLazyWrite( current->SharedCacheMap->LazyWriteContext); @@ -344,7 +332,7 @@ retry: CcRosVacbIncRefCount(current); /* Check if it's mapped and not dirty */ - if (current->MappedCount > 0 && !current->Dirty) + if (InterlockedCompareExchange((PLONG)¤t->MappedCount, 0, 0) > 0 && !current->Dirty) { /* We have to break these locks because Cc sucks */ KeReleaseSpinLock(¤t->SharedCacheMap->CacheMapLock, oldIrql); @@ -375,6 +363,7 @@ retry: RemoveEntryList(¤t->CacheMapVacbListEntry); RemoveEntryList(¤t->VacbLruListEntry); + InitializeListHead(¤t->VacbLruListEntry); InsertHeadList(&FreeList, ¤t->CacheMapVacbListEntry); /* Calculate how many pages we freed for Mm */ @@ -409,12 +398,15 @@ retry: while (!IsListEmpty(&FreeList)) { + ULONG Refs; + current_entry = RemoveHeadList(&FreeList); current = CONTAINING_RECORD(current_entry, ROS_VACB, CacheMapVacbListEntry); - CcRosVacbDecRefCount(current); - CcRosInternalFreeVacb(current); + InitializeListHead(¤t->CacheMapVacbListEntry); + Refs = CcRosVacbDecRefCount(current); + ASSERT(Refs == 0); } DPRINT("Evicted %lu cache pages\n", (*NrFreed)); @@ -446,18 +438,16 @@ CcRosReleaseVacb ( if (Mapped) { - Vacb->MappedCount++; + if (InterlockedIncrement((PLONG)&Vacb->MappedCount) == 1) + { + CcRosVacbIncRefCount(Vacb); + } } + Refs = CcRosVacbDecRefCount(Vacb); - if (Mapped && (Vacb->MappedCount == 1)) - { - CcRosVacbIncRefCount(Vacb); - } ASSERT(Refs > 0); - CcRosReleaseVacbLock(Vacb); - return STATUS_SUCCESS; } @@ -493,7 +483,6 @@ CcRosLookupVacb ( CcRosVacbIncRefCount(current); KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql); KeReleaseGuardedMutex(&ViewLock); - CcRosAcquireVacbLock(current, NULL); return current; } if (current->FileOffset.QuadPart > FileOffset) @@ -567,6 +556,7 @@ CcRosUnmarkDirtyVacb ( Vacb->Dirty = FALSE; RemoveEntryList(&Vacb->DirtyVacbListEntry); + InitializeListHead(&Vacb->DirtyVacbListEntry); CcTotalDirtyPages -= VACB_MAPPING_GRANULARITY / PAGE_SIZE; Vacb->SharedCacheMap->DirtyPages -= VACB_MAPPING_GRANULARITY / PAGE_SIZE; CcRosVacbDecRefCount(Vacb); @@ -627,9 +617,7 @@ CcRosUnmapVacb ( } ASSERT(Vacb->MappedCount != 0); - Vacb->MappedCount--; - - if (Vacb->MappedCount == 0) + if (InterlockedDecrement((PLONG)&Vacb->MappedCount) == 0) { CcRosVacbDecRefCount(Vacb); } @@ -718,6 +706,7 @@ CcRosCreateVacb ( PLIST_ENTRY current_entry; NTSTATUS Status; KIRQL oldIrql; + ULONG Refs; ASSERT(SharedCacheMap); @@ -743,12 +732,23 @@ CcRosCreateVacb ( } #endif current->MappedCount = 0; - current->DirtyVacbListEntry.Flink = NULL; - current->DirtyVacbListEntry.Blink = NULL; current->ReferenceCount = 0; current->PinCount = 0; - KeInitializeMutex(¤t->Mutex, 0); - CcRosAcquireVacbLock(current, NULL); + InitializeListHead(¤t->CacheMapVacbListEntry); + InitializeListHead(¤t->DirtyVacbListEntry); + InitializeListHead(¤t->VacbLruListEntry); + + CcRosVacbIncRefCount(current); + + Status = CcRosMapVacbInKernelSpace(current); + if (!NT_SUCCESS(Status)) + { + Refs = CcRosVacbDecRefCount(current); + ASSERT(Refs == 0); + + return Status; + } + KeAcquireGuardedMutex(&ViewLock); *Vacb = current; @@ -780,11 +780,12 @@ CcRosCreateVacb ( current); } #endif - CcRosReleaseVacbLock(*Vacb); KeReleaseGuardedMutex(&ViewLock); - ExFreeToNPagedLookasideList(&VacbLookasideList, *Vacb); + + Refs = CcRosVacbDecRefCount(*Vacb); + ASSERT(Refs == 0); + *Vacb = current; - CcRosAcquireVacbLock(current, NULL); return STATUS_SUCCESS; } if (current->FileOffset.QuadPart < FileOffset) @@ -809,7 +810,6 @@ CcRosCreateVacb ( } KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql); InsertTailList(&VacbLruListHead, ¤t->VacbLruListEntry); - CcRosVacbIncRefCount(current); KeReleaseGuardedMutex(&ViewLock); MI_SET_USAGE(MI_USAGE_CACHE); @@ -834,17 +834,6 @@ CcRosCreateVacb ( /* Reference it to allow release */ CcRosVacbIncRefCount(current); - Status = CcRosMapVacbInKernelSpace(current); - if (!NT_SUCCESS(Status)) - { - RemoveEntryList(¤t->CacheMapVacbListEntry); - RemoveEntryList(¤t->VacbLruListEntry); - CcRosReleaseVacb(SharedCacheMap, current, FALSE, - FALSE, FALSE); - CcRosVacbDecRefCount(current); - ExFreeToNPagedLookasideList(&VacbLookasideList, current); - } - return Status; } @@ -988,6 +977,9 @@ CcRosInternalFreeVacb ( ASSERT(Vacb->PinCount == 0); ASSERT(Vacb->ReferenceCount == 0); + ASSERT(IsListEmpty(&Vacb->CacheMapVacbListEntry)); + ASSERT(IsListEmpty(&Vacb->DirtyVacbListEntry)); + ASSERT(IsListEmpty(&Vacb->VacbLruListEntry)); RtlFillMemory(Vacb, sizeof(Vacb), 0xfd); ExFreeToNPagedLookasideList(&VacbLookasideList, Vacb); return STATUS_SUCCESS; @@ -1107,8 +1099,8 @@ CcRosDeleteFileCache ( KeReleaseSpinLock(&SharedCacheMap->CacheMapLock, oldIrql); current = CONTAINING_RECORD(current_entry, ROS_VACB, CacheMapVacbListEntry); - CcRosAcquireVacbLock(current, NULL); RemoveEntryList(¤t->VacbLruListEntry); + InitializeListHead(¤t->VacbLruListEntry); if (current->Dirty) { KeAcquireSpinLock(&SharedCacheMap->CacheMapLock, &oldIrql); @@ -1117,7 +1109,6 @@ CcRosDeleteFileCache ( DPRINT1("Freeing dirty VACB\n"); } InsertHeadList(&FreeList, ¤t->CacheMapVacbListEntry); - CcRosReleaseVacbLock(current); KeAcquireSpinLock(&SharedCacheMap->CacheMapLock, &oldIrql); } @@ -1131,10 +1122,13 @@ CcRosDeleteFileCache ( while (!IsListEmpty(&FreeList)) { + ULONG Refs; + current_entry = RemoveTailList(&FreeList); current = CONTAINING_RECORD(current_entry, ROS_VACB, CacheMapVacbListEntry); - CcRosVacbDecRefCount(current); - CcRosInternalFreeVacb(current); + InitializeListHead(¤t->CacheMapVacbListEntry); + Refs = CcRosVacbDecRefCount(current); + ASSERT(Refs == 0); } OldIrql = KeAcquireQueuedSpinLock(LockQueueMasterLock); diff --git a/ntoskrnl/include/internal/cc.h b/ntoskrnl/include/internal/cc.h index e3c279b..0dcea16 100644 --- a/ntoskrnl/include/internal/cc.h +++ b/ntoskrnl/include/internal/cc.h @@ -217,12 +217,9 @@ typedef struct _ROS_VACB LIST_ENTRY VacbLruListEntry; /* Offset in the file which this view maps. */ LARGE_INTEGER FileOffset; - /* Mutex */ - KMUTEX Mutex; /* Number of references. */ volatile ULONG ReferenceCount; /* How many times was it pinned? */ - _Guarded_by_(Mutex) LONG PinCount; /* Pointer to the shared cache map for the file which this view maps data for. */ PROS_SHARED_CACHE_MAP SharedCacheMap; @@ -470,28 +467,9 @@ VOID CcPerformReadAhead( IN PFILE_OBJECT FileObject); -FORCEINLINE NTSTATUS -CcRosAcquireVacbLock( - _Inout_ PROS_VACB Vacb, - _In_ PLARGE_INTEGER Timeout) -{ - NTSTATUS Status; - Status = KeWaitForSingleObject(&Vacb->Mutex, - Executive, - KernelMode, - FALSE, - Timeout); - return Status; -} - -FORCEINLINE -VOID -CcRosReleaseVacbLock( - _Inout_ PROS_VACB Vacb) -{ - KeReleaseMutex(&Vacb->Mutex, FALSE); -} +CcRosInternalFreeVacb( + IN PROS_VACB Vacb); FORCEINLINE BOOLEAN @@ -545,6 +523,19 @@ CcRosVacbGetRefCount_( #else #define CcRosVacbIncRefCount(vacb) InterlockedIncrement((PLONG)&(vacb)->ReferenceCount) -#define CcRosVacbDecRefCount(vacb) InterlockedDecrement((PLONG)&(vacb)->ReferenceCount) +FORCEINLINE +ULONG +CcRosVacbDecRefCount( + PROS_VACB vacb) +{ + ULONG Refs; + + Refs = InterlockedDecrement((PLONG)&vacb->ReferenceCount); + if (Refs == 0) + { + CcRosInternalFreeVacb(vacb); + } + return Refs; +} #define CcRosVacbGetRefCount(vacb) InterlockedCompareExchange((PLONG)&(vacb)->ReferenceCount, 0, 0) #endif diff --git a/ntoskrnl/io/iomgr/irq.c b/ntoskrnl/io/iomgr/irq.c index a604be1..eb685fd 100644 --- a/ntoskrnl/io/iomgr/irq.c +++ b/ntoskrnl/io/iomgr/irq.c @@ -62,6 +62,9 @@ IoConnectInterrupt(OUT PKINTERRUPT *InterruptObject, TAG_KINTERRUPT); if (!IoInterrupt) return STATUS_INSUFFICIENT_RESOURCES; + DPRINT1("Connecting interrupt %p for caller %p\n", IoInterrupt, _ReturnAddress()); + KeRosDumpStackFrames(NULL, 5); + /* Select which Spinlock to use */ SpinLockUsed = SpinLock ? SpinLock : &IoInterrupt->SpinLock; diff --git a/ntoskrnl/ke/i386/irqobj.c b/ntoskrnl/ke/i386/irqobj.c index 8fb51f7..d3e479f 100644 --- a/ntoskrnl/ke/i386/irqobj.c +++ b/ntoskrnl/ke/i386/irqobj.c @@ -303,16 +303,16 @@ KiChainedDispatch(IN PKTRAP_FRAME TrapFrame, } } -VOID +PKI_INTERRUPT_DISPATCH FASTCALL -KiInterruptTemplateHandler(IN PKTRAP_FRAME TrapFrame, - IN PKINTERRUPT Interrupt) +KiInterruptTemplateHandler2(IN PKTRAP_FRAME TrapFrame, + IN PKINTERRUPT Interrupt) { /* Enter interrupt frame */ KiEnterInterruptTrap(TrapFrame); - /* Call the correct dispatcher */ - ((PKI_INTERRUPT_DISPATCH)Interrupt->DispatchAddress)(TrapFrame, Interrupt); + /* Return the correct dispatcher */ + return (PKI_INTERRUPT_DISPATCH)Interrupt->DispatchAddress; } diff --git a/ntoskrnl/ke/i386/trap.s b/ntoskrnl/ke/i386/trap.s index 01d130e..8b25e46 100644 --- a/ntoskrnl/ke/i386/trap.s +++ b/ntoskrnl/ke/i386/trap.s @@ -123,7 +123,18 @@ TRAP_ENTRY KiDebugService, KI_PUSH_FAKE_ERROR_CODE TRAP_ENTRY KiUnexpectedInterruptTail, 0 ALIGN 4 -EXTERN @KiInterruptTemplateHandler@8:PROC +EXTERN @KiInterruptTemplateHandler2@8:PROC +PUBLIC @KiInterruptTemplateHandler@8 +.PROC @KiInterruptTemplateHandler@8 + push ecx + push edx + call @KiInterruptTemplateHandler2@8 + pop edx + pop ecx + jmp eax +.ENDP + +ALIGN 4 PUBLIC _KiInterruptTemplate _KiInterruptTemplate: KiEnterTrap KI_PUSH_FAKE_ERROR_CODE diff --git a/ntoskrnl/ke/i386/traphdlr.c b/ntoskrnl/ke/i386/traphdlr.c index 27ae26c..156d2c5 100644 --- a/ntoskrnl/ke/i386/traphdlr.c +++ b/ntoskrnl/ke/i386/traphdlr.c @@ -138,10 +138,10 @@ KiEoiHelper(IN PKTRAP_FRAME TrapFrame) if (KiIsFrameEdited(TrapFrame)) KiEditedTrapReturn(TrapFrame); /* Check if we have single stepping enabled */ - if (TrapFrame->EFlags & EFLAGS_TF) KiTrapReturnNoSegments(TrapFrame); + //if (TrapFrame->EFlags & EFLAGS_TF) KiTrapReturnNoSegments(TrapFrame); /* Exit the trap to kernel mode */ - KiTrapReturnNoSegmentsRet8(TrapFrame); + KiTrapReturnNoSegments(TrapFrame); } DECLSPEC_NORETURN