ULONG SymGetSymbolCount(void)
{
	ASSERTMSG("SymbolEngine must be initialized prior to this call", bIsSymEngineInitialized == TRUE);

	// immediately acquire mutex, because of current count query
	ASSERTMSG("Fast mutex acquire must occur at or below APC_LEVEL", KeGetCurrentIrql() <= APC_LEVEL);
	ExAcquireFastMutex(&SymbolsListMutex);
	if(uSymbolCount != 0)
	{
		ASSERTMSG("Fast mutex release must occur at APC_LEVEL", KeGetCurrentIrql() == APC_LEVEL);
		ExReleaseFastMutex(&SymbolsListMutex);
		return uSymbolCount;
	}

	PLIST_ENTRY symbolListEntry = SymbolsListHead.Flink;
	ULONG uTmpSymbolCount = 0;

	// iterate through symbols list
	while(symbolListEntry != &SymbolsListHead)
	{
		++uTmpSymbolCount;
		symbolListEntry = symbolListEntry->Flink;
	}

	// release the spinlock and return the count
	uSymbolCount = uTmpSymbolCount;
	ASSERTMSG("Fast mutex release must occur at APC_LEVEL", KeGetCurrentIrql() == APC_LEVEL);
	ExReleaseFastMutex(&SymbolsListMutex);
	return uTmpSymbolCount;
}

BOOLEAN SymUpdateSymbol(IN PINTERNAL_SYMBOL pSymbol)
{
	ASSERTMSG("Passed symbol cannot be NULL", pSymbol != NULL);
	ASSERTMSG("SymbolEngine must be initialized prior to this call", bIsSymEngineInitialized == TRUE);

	PSYMBOL_ENTRY pWantedSymbol = SympFindSymbol(pSymbol->name);
	ASSERTMSG("Fast mutex acquire must occur at or below APC_LEVEL", KeGetCurrentIrql() <= APC_LEVEL);
	ExAcquireFastMutex(&SymbolsListMutex);
	if(pWantedSymbol == NULL)
	{
		KdPrint(("[DEBUG] ERROR - %s private symbol does not exist!\n", pSymbol->name));
		ASSERTMSG("Fast mutex release must occur at APC_LEVEL", KeGetCurrentIrql() == APC_LEVEL);
		ExReleaseFastMutex(&SymbolsListMutex);
		return FALSE;
	}

	// update all symbol fields
	pWantedSymbol->Symbol.u64address = pSymbol->u64address;
	pWantedSymbol->Symbol.uOffset = pSymbol->uOffset;
	pWantedSymbol->Symbol.uBitPosition = pSymbol->uBitPosition;
	pWantedSymbol->Symbol.uBitLength = pSymbol->uBitLength;

	ASSERTMSG("Fast mutex release must occur at APC_LEVEL", KeGetCurrentIrql() == APC_LEVEL);
	ExReleaseFastMutex(&SymbolsListMutex);
	return TRUE;
}

_Use_decl_annotations_
NTSTATUS NotificationCopy(
	PVOID			Buffer,
	ULONG			BufferSize,
	PULONG			BytesRead
)
{
	PLIST_ENTRY pListEntry;
	PNOTIFICATION_ENTRY pEntry;
	if (BufferSize < sizeof(OBSERVER_NOTIFICATION))
	{
		return STATUS_BUFFER_TOO_SMALL;
	}

	ExAcquireFastMutex(&NotificationListMutex);
	if (IsListEmpty(&NotificationList))
	{
		ExReleaseFastMutex(&NotificationListMutex);
		*BytesRead = 0;
		return STATUS_MORE_PROCESSING_REQUIRED;
	}
	pListEntry = RemoveHeadList(&NotificationList);
	ExReleaseFastMutex(&NotificationListMutex);
	pEntry = CONTAINING_RECORD(pListEntry, NOTIFICATION_ENTRY, ListEntry);
	RtlCopyMemory(Buffer, &pEntry->Data, sizeof(OBSERVER_NOTIFICATION));
	*BytesRead = sizeof(OBSERVER_NOTIFICATION);
	NOTIFICATION_FREE(pEntry);
	return STATUS_SUCCESS;
}

PVOID
ExAllocateFromPagedLookasideList(
    IN PPAGED_LOOKASIDE_LIST Lookaside
    )

/*++

Routine Description:

    This function removes (pops) the first entry from the specified
    paged lookaside list.

Arguments:

    Lookaside - Supplies a pointer to a paged lookaside list structure.

Return Value:

    If an entry is removed from the specified lookaside list, then the
    address of the entry is returned as the function value. Otherwise,
    NULL is returned.

--*/

{

    PVOID Entry;

    Lookaside->L.TotalAllocates += 1;

    if (Isx86FeaturePresent(KF_CMPXCHG8B)) {
        if ((Entry = ExInterlockedPopEntrySList(&Lookaside->L.ListHead,
                                                NULL)) == NULL) {

            Lookaside->L.AllocateMisses += 1;
            Entry = (Lookaside->L.Allocate)(Lookaside->L.Type,
                                            Lookaside->L.Size,
                                            Lookaside->L.Tag);
        }

        return Entry;
    }

    ExAcquireFastMutex(&Lookaside->Lock);
    Entry = PopEntryList(&Lookaside->L.ListHead.Next);
    if (Entry == NULL) {
        ExReleaseFastMutex(&Lookaside->Lock);
        Lookaside->L.AllocateMisses += 1;
        Entry = (Lookaside->L.Allocate)(Lookaside->L.Type,
                                        Lookaside->L.Size,
                                        Lookaside->L.Tag);

    } else {
        Lookaside->L.ListHead.Depth -= 1;
        ExReleaseFastMutex(&Lookaside->Lock);
    }

    return Entry;
}

VOID
ExFreeToPagedLookasideList(
    IN PPAGED_LOOKASIDE_LIST Lookaside,
    IN PVOID Entry
    )

/*++

Routine Description:

    This function inserts (pushes) the specified entry into the specified
    paged lookaside list.

Arguments:

    Lookaside - Supplies a pointer to a paged lookaside list structure.

    Entry - Supples a pointer to the entry that is inserted in the
        lookaside list.

Return Value:

    None.

--*/

{

    Lookaside->L.TotalFrees += 1;

    if (Isx86FeaturePresent(KF_CMPXCHG8B)) {
        if (ExQueryDepthSList(&Lookaside->L.ListHead) >= Lookaside->L.Depth) {
            Lookaside->L.FreeMisses += 1;
            (Lookaside->L.Free)(Entry);

        } else {
            ExInterlockedPushEntrySList(&Lookaside->L.ListHead,
                                        (PSINGLE_LIST_ENTRY)Entry,
                                        NULL);
        }

        return;
    }

    ExAcquireFastMutex(&Lookaside->Lock);
    if (ExQueryDepthSList(&Lookaside->L.ListHead) >= Lookaside->L.Depth) {
        ExReleaseFastMutex(&Lookaside->Lock);
        Lookaside->L.FreeMisses += 1;
        (Lookaside->L.Free)(Entry);

    } else {
        PushEntryList(&Lookaside->L.ListHead.Next, (PSINGLE_LIST_ENTRY)Entry);
        Lookaside->L.ListHead.Depth += 1;
        ExReleaseFastMutex(&Lookaside->Lock);
    }

    return;
}

VOID LockLcxlMutexRead(PMultiReadMutex pMutex)//加锁读互斥
{
	ExAcquireFastMutex(&pMutex->z);
	ExAcquireFastMutex(&pMutex->kReadMutex);
	if (pMutex->iReadCount == 0) {
		KeWaitForSingleObject(&pMutex->kRWMutex, Executive, KernelMode, FALSE, NULL);
	}
	pMutex->iReadCount++;
	ExReleaseFastMutex(&pMutex->kReadMutex);
	ExReleaseFastMutex(&pMutex->z);
}

PNDAS_CCB
ReadonlyLookUpCcbByReadonlyFileObject (
	IN PFILESPY_DEVICE_EXTENSION	DevExt,
	IN PFILE_OBJECT					ReadonlyFileObject
	)
{
	PNDAS_CCB		ccb = NULL;
    PLIST_ENTRY		listEntry;

	
    ExAcquireFastMutex( &DevExt->LfsDeviceExt.Readonly->CcbQMutex );

    for (listEntry = DevExt->LfsDeviceExt.Readonly->CcbQueue.Flink;
         listEntry != &DevExt->LfsDeviceExt.Readonly->CcbQueue;
         listEntry = listEntry->Flink) {

		 ccb = CONTAINING_RECORD( listEntry, NDAS_CCB, ListEntry );
         
		 if (ccb->ReadonlyFileObject == ReadonlyFileObject)
			break;

		ccb = NULL;
	}

    ExReleaseFastMutex( &DevExt->LfsDeviceExt.Readonly->CcbQMutex );

	return ccb;
}

PNDAS_CCB
ReadonlyLookUpCcb (
	IN PREADONLY	Readonly,
	IN PFILE_OBJECT	FileObject
	)
{
	PNDAS_CCB		ccb = NULL;
    PLIST_ENTRY		listEntry;

	
    ExAcquireFastMutex( &Readonly->CcbQMutex );

    for (listEntry = Readonly->CcbQueue.Flink;
         listEntry != &Readonly->CcbQueue;
         listEntry = listEntry->Flink) {

		 ccb = CONTAINING_RECORD( listEntry, NDAS_CCB, ListEntry );
         
		 if (ccb->FileObject == FileObject)
			break;

		ccb = NULL;
	}

    ExReleaseFastMutex( &Readonly->CcbQMutex );

	return ccb;
}

VOID
ReadonlyFreeCcb (
	IN PFILESPY_DEVICE_EXTENSION	DevExt,
	IN PNDAS_CCB					Ccb
	)
{
	PLIST_ENTRY		listEntry;


	ASSERT( Ccb->ListEntry.Flink == Ccb->ListEntry.Blink );


	ExAcquireFastMutex( &DevExt->LfsDeviceExt.Readonly->CcbQMutex );

    for (listEntry = DevExt->LfsDeviceExt.Readonly->CcbQueue.Flink;
         listEntry != &DevExt->LfsDeviceExt.Readonly->CcbQueue;
         listEntry = listEntry->Flink) {

		PNDAS_CCB	childCcb;
		
		childCcb = CONTAINING_RECORD( listEntry, NDAS_CCB, ListEntry );
        
		if (childCcb->CreateContext.RelatedFileHandle == Ccb->ReadonlyFileHandle)
			childCcb->RelatedFileObjectClosed = TRUE;
	}

    ExReleaseFastMutex( &DevExt->LfsDeviceExt.Readonly->CcbQMutex );

	InterlockedDecrement( &DevExt->LfsDeviceExt.Readonly->CcbCount );

	ExFreePoolWithTag( Ccb, LFS_CCB_TAG );
}

//
// Find a thread exemption in the list of exemptions and return its pointer
//
PTHREAD_EXEMPTION FindThreadExemption(
		IN PVOID Thread,
		IN BOOLEAN LockList)
{
	PTHREAD_EXEMPTION Exemption = NULL;
	PLIST_ENTRY       Current;

	if (LockList)
		ExAcquireFastMutex(
				&ThreadExemptionListMutex);

	for (Current = ThreadExemptionList.Flink;
	     Current != &ThreadExemptionList;
	     Current = Current->Flink)
	{
		PTHREAD_EXEMPTION CurrentExemption = (PTHREAD_EXEMPTION)Current;

		//
		// If the current entry's thread matches the one that is requested, return
		// its pointer
		//
		if (CurrentExemption->Thread == Thread)
		{
			Exemption = CurrentExemption;
			break;
		}
	}
	
	if (LockList)
		ExReleaseFastMutex(
				&ThreadExemptionListMutex);

	return Exemption;
}

static NTSTATUS CfixkrsRegisterChildThreadFilament(
	__in PCFIXKRP_FILAMENT Filament,
	__in HANDLE Thread
	)
{
	NTSTATUS Status;

	ASSERT( Filament );
	ASSERT( Thread );
	ASSERT( KeGetCurrentIrql() == PASSIVE_LEVEL );

	ExAcquireFastMutex( &Filament->ChildThreads.Lock );
	
	if ( Filament->ChildThreads.ThreadCount ==
		_countof( Filament->ChildThreads.Threads ) )
	{
		Status = STATUS_ALLOTTED_SPACE_EXCEEDED;
		goto Cleanup;
	}

	Filament->ChildThreads.Threads[ 
		Filament->ChildThreads.ThreadCount++ ] = Thread;

	Status = STATUS_SUCCESS;

Cleanup:
	ExReleaseFastMutex( &Filament->ChildThreads.Lock );

	return Status;
}

static VOID
XenvbdTargetStop(ULONG target_id)
{
    PXHBD_TARGET_INFO targetInfo;
    KIRQL irql;

    TraceNotice(("target %d: %s\n", target_id, __FUNCTION__));

    irql = acquire_irqsafe_lock(XenvbdTargetInfoLock);
    targetInfo = XenvbdTargetInfo[target_id];
    XM_ASSERT(targetInfo != NULL);
    
    targetInfo->References++;
    release_irqsafe_lock(XenvbdTargetInfoLock, irql);

    XM_ASSERT(KeGetCurrentIrql() < DISPATCH_LEVEL);

    ExAcquireFastMutex(&targetInfo->StateLock);
    targetInfo->Started = FALSE;
    ExReleaseFastMutex(&targetInfo->StateLock);

    irql = acquire_irqsafe_lock(XenvbdTargetInfoLock);
    XM_ASSERT(targetInfo->References != 0);
    targetInfo->References--;
    release_irqsafe_lock(XenvbdTargetInfoLock, irql);
}

//
//	Increment the reference count to a PDO.
//
PPDO_DEVICE_DATA
LookupPdoData(
	PFDO_DEVICE_DATA	FdoData,
	ULONG				SystemIoBusNumber
	)
{
	PPDO_DEVICE_DATA	pdoData = NULL;
    PLIST_ENTRY         entry;

    PAGED_CODE ();

    KeEnterCriticalRegion();
	ExAcquireFastMutex (&FdoData->Mutex);

    for (entry = FdoData->ListOfPDOs.Flink;
         entry != &FdoData->ListOfPDOs;
         entry = entry->Flink) {

			 pdoData = CONTAINING_RECORD (entry, PDO_DEVICE_DATA, Link);
             if(pdoData->SlotNo == SystemIoBusNumber)
				 break;
			pdoData = NULL;
		 }
	 if(pdoData) {
		 //
		 //	increment the reference count to the PDO.
		 //
		 ObReferenceObject(pdoData->Self);
	 }

	ExReleaseFastMutex (&FdoData->Mutex);
    KeLeaveCriticalRegion();

	return pdoData;
}

NTSTATUS
NTAPI
CompBattDisableStatusNotify(IN PCOMPBATT_DEVICE_EXTENSION DeviceExtension)
{
    PCOMPBATT_BATTERY_DATA BatteryData;
    PLIST_ENTRY ListHead, NextEntry;
    if (CompBattDebug & 0x100) DbgPrint("CompBatt: ENTERING DisableStatusNotify\n");

    /* Loop the battery list */
    ExAcquireFastMutex(&DeviceExtension->Lock);
    ListHead = &DeviceExtension->BatteryList;
    NextEntry = ListHead->Flink;
    while (NextEntry != ListHead)
    {
        /* Get the battery information and clear capacity data */
        BatteryData = CONTAINING_RECORD(NextEntry, COMPBATT_BATTERY_DATA, BatteryLink);
        BatteryData->WaitStatus.LowCapacity = 0;
        BatteryData->WaitStatus.HighCapacity = 0x7FFFFFFF;
        NextEntry = NextEntry->Flink;
    }

    /* Done */
    ExReleaseFastMutex(&DeviceExtension->Lock);
    if (CompBattDebug & 0x100) DbgPrint("CompBatt: EXITING DisableStatusNotify\n");
    return STATUS_SUCCESS;
}

BOOLEAN SymRemoveSymbol(IN PCHAR pszSymbolName)
{
	ASSERTMSG("Passed symbol name is NULL", pszSymbolName != NULL);
	ASSERTMSG("SymbolEngine must be initialized prior to this call", bIsSymEngineInitialized == TRUE);

	// try to find the symbol to remove
	PSYMBOL_ENTRY pSymbolEntry = SympFindSymbol(pszSymbolName);
	// if symbol not found, return NULL
	if(pSymbolEntry == NULL)
	{
		return FALSE;
	}

	// symbol found, so we remove it from the list...
	ASSERTMSG("Fast mutex acquire must occur at or below APC_LEVEL", KeGetCurrentIrql() <= APC_LEVEL);
	ExAcquireFastMutex(&SymbolsListMutex);
	RemoveEntryList(&pSymbolEntry->ListEntry);

	// decrease symbol count (do it inside guarded block!)
	--uSymbolCount;

	// and free allocated memory
	ExFreeToNPagedLookasideList(&SymbolsLookasideList, pSymbolEntry);
	ASSERTMSG("Fast mutex release must occur at APC_LEVEL", KeGetCurrentIrql() == APC_LEVEL);
	ExReleaseFastMutex(&SymbolsListMutex);

	return TRUE;
}

NTSTATUS CfixkrpJoinChildThreadsFilament(
	__in PCFIXKRP_FILAMENT Filament,
	__in_opt PLARGE_INTEGER Timeout
	)
{
	NTSTATUS Status;

	ASSERT( KeGetCurrentIrql() == PASSIVE_LEVEL );

	ExAcquireFastMutex( &Filament->ChildThreads.Lock );
	
	if ( Filament->ChildThreads.ThreadCount > 0 )
	{
		KWAIT_BLOCK WaitBlocks[ CFIX_MAX_THREADS ];

		Status = KeWaitForMultipleObjects(
			Filament->ChildThreads.ThreadCount,
			Filament->ChildThreads.Threads,
			WaitAll,
			Executive,
			KernelMode,
			FALSE,
			Timeout,
			WaitBlocks );
	}
	else
	{
		Status = STATUS_SUCCESS;
	}

	ExReleaseFastMutex( &Filament->ChildThreads.Lock );

	return Status;
}

NTSTATUS
NTAPI
BeepClose(IN PDEVICE_OBJECT DeviceObject,
          IN PIRP Irp)
{
    PDEVICE_EXTENSION DeviceExtension = DeviceObject->DeviceExtension;

    /* Acquire the mutex and decrease reference count */
    ExAcquireFastMutex(&DeviceExtension->Mutex);
    if (!(--DeviceExtension->ReferenceCount))
    {
        /* Check for active timer */
        if (DeviceExtension->TimerActive)
        {
            /* Cancel it */
            if (KeCancelTimer(&DeviceExtension->Timer))
            {
                /* Mark it as cancelled */
                InterlockedDecrement(&DeviceExtension->TimerActive);
            }
        }

        /* Page the driver */
        MmUnlockPagableImageSection(DeviceExtension->SectionHandle);
    }

    /* Release the lock */
    ExReleaseFastMutex(&DeviceExtension->Mutex);

    /* Complete the request */
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

PLFS_CCB
Secondary_LookUpCcb (
	IN PSECONDARY	Secondary,
	IN PFILE_OBJECT	FileObject
	)
{
	PLFS_CCB	ccb = NULL;
    PLIST_ENTRY		listEntry;

	
    ExAcquireFastMutex( &Secondary->CcbQMutex );

    for (listEntry = Secondary->CcbQueue.Flink;
         listEntry != &Secondary->CcbQueue;
         listEntry = listEntry->Flink) {

		ccb = CONTAINING_RECORD( listEntry, LFS_CCB, ListEntry );
         
		if (ccb->FileObject == FileObject) {

			break;
		}

		ccb = NULL;
	}

    ExReleaseFastMutex( &Secondary->CcbQMutex );

	return ccb;
}

VOID
FreeCcb (
	IN  PSECONDARY		Secondary,
	IN  PLFS_CCB	Ccb
	)
{
	PLIST_ENTRY		listEntry;


	ASSERT( Ccb->ListEntry.Flink == Ccb->ListEntry.Blink );

	ExAcquireFastMutex( &Secondary->CcbQMutex );

    for (listEntry = Secondary->CcbQueue.Flink;
         listEntry != &Secondary->CcbQueue;
         listEntry = listEntry->Flink) {

		PLFS_CCB	childCcb;
		
		childCcb = CONTAINING_RECORD( listEntry, LFS_CCB, ListEntry );
        
		if (childCcb->CreateContext.RelatedFileHandle == Ccb->PrimaryFileHandle)
			childCcb->RelatedFileObjectClosed = TRUE;
	}

    ExReleaseFastMutex( &Secondary->CcbQMutex );

	InterlockedDecrement( &Secondary->CcbCount );

	ExFreePoolWithTag( Ccb, LFS_CCB_TAG );
}

static void hook_dump_entry()
{
	PLDR_DATA_TABLE_ENTRY table;
	entry_hook           *ehook;

	ExAcquireFastMutex(&dump_sync);

	if (dump_imgbase != NULL && (table = find_image(dump_imgbase)))
	{
		if (table->BaseDllName.Buffer != NULL && table->EntryPoint != NULL &&
			img_cmp(&table->BaseDllName, L"dump_") || img_cmp(&table->BaseDllName, L"hiber_"))
		{
			if (ehook = mm_alloc(sizeof(entry_hook), 0))
			{
				memcpy(ehook->code, jmp_code, sizeof(jmp_code));
				ppv(ehook->code + DEST_OFF)[0] = dump_driver_entry;
				ppv(ehook->code + PARM_OFF)[0] = ehook;
				ehook->old_entry  = table->EntryPoint;
				table->EntryPoint = pv(ehook->code);					
			}
		}
		dump_imgbase = NULL;
	}
	ExReleaseFastMutex(&dump_sync);
}