[NTOS]: Fix kernel memory corruption when dequeuing a PnP event
[reactos.git] / reactos / ntoskrnl / io / pnpmgr / plugplay.c
1 /*
2 * PROJECT: ReactOS Kernel
3 * COPYRIGHT: GPL - See COPYING in the top level directory
4 * FILE: ntoskrnl/io/pnpmgr/plugplay.c
5 * PURPOSE: Plug-and-play interface routines
6 * PROGRAMMERS: Eric Kohl <eric.kohl@t-online.de>
7 */
8
9 /* INCLUDES *****************************************************************/
10
11 #include <ntoskrnl.h>
12 #define NDEBUG
13 #include <debug.h>
14
15 #if defined (ALLOC_PRAGMA)
16 #pragma alloc_text(INIT, IopInitPlugPlayEvents)
17 #endif
18
19 typedef struct _PNP_EVENT_ENTRY
20 {
21 LIST_ENTRY ListEntry;
22 PLUGPLAY_EVENT_BLOCK Event;
23 } PNP_EVENT_ENTRY, *PPNP_EVENT_ENTRY;
24
25
26 /* GLOBALS *******************************************************************/
27
28 static LIST_ENTRY IopPnpEventQueueHead;
29 static KEVENT IopPnpNotifyEvent;
30
31 /* FUNCTIONS *****************************************************************/
32
33 NTSTATUS INIT_FUNCTION
34 IopInitPlugPlayEvents(VOID)
35 {
36 InitializeListHead(&IopPnpEventQueueHead);
37
38 KeInitializeEvent(&IopPnpNotifyEvent,
39 SynchronizationEvent,
40 FALSE);
41
42 return STATUS_SUCCESS;
43 }
44
45 NTSTATUS
46 IopQueueTargetDeviceEvent(const GUID *Guid,
47 PUNICODE_STRING DeviceIds)
48 {
49 PPNP_EVENT_ENTRY EventEntry;
50 UNICODE_STRING Copy;
51 ULONG TotalSize;
52 NTSTATUS Status;
53
54 ASSERT(DeviceIds);
55
56 /* Allocate a big enough buffer */
57 Copy.Length = 0;
58 Copy.MaximumLength = DeviceIds->Length + sizeof(UNICODE_NULL);
59 TotalSize =
60 FIELD_OFFSET(PLUGPLAY_EVENT_BLOCK, TargetDevice.DeviceIds) +
61 Copy.MaximumLength;
62
63 EventEntry = ExAllocatePool(NonPagedPool,
64 TotalSize + FIELD_OFFSET(PNP_EVENT_ENTRY, Event));
65 if (!EventEntry)
66 return STATUS_INSUFFICIENT_RESOURCES;
67
68 /* Fill the buffer with the event GUID */
69 RtlCopyMemory(&EventEntry->Event.EventGuid,
70 Guid,
71 sizeof(GUID));
72 EventEntry->Event.EventCategory = TargetDeviceChangeEvent;
73 EventEntry->Event.TotalSize = TotalSize;
74
75 /* Fill the device id */
76 Copy.Buffer = EventEntry->Event.TargetDevice.DeviceIds;
77 Status = RtlAppendUnicodeStringToString(&Copy, DeviceIds);
78 if (!NT_SUCCESS(Status))
79 return Status;
80
81 InsertHeadList(&IopPnpEventQueueHead,
82 &EventEntry->ListEntry);
83 KeSetEvent(&IopPnpNotifyEvent,
84 0,
85 FALSE);
86
87 return STATUS_SUCCESS;
88 }
89
90
91 /*
92 * Remove the current PnP event from the tail of the event queue
93 * and signal IopPnpNotifyEvent if there is yet another event in the queue.
94 */
95 static NTSTATUS
96 IopRemovePlugPlayEvent(VOID)
97 {
98 /* Remove a pnp event entry from the tail of the queue */
99 if (!IsListEmpty(&IopPnpEventQueueHead))
100 {
101 ExFreePool(CONTAINING_RECORD(RemoveTailList(&IopPnpEventQueueHead), PNP_EVENT_ENTRY, ListEntry)));
102 }
103
104 /* Signal the next pnp event in the queue */
105 if (!IsListEmpty(&IopPnpEventQueueHead))
106 {
107 KeSetEvent(&IopPnpNotifyEvent,
108 0,
109 FALSE);
110 }
111
112 return STATUS_SUCCESS;
113 }
114
115 static PDEVICE_OBJECT
116 IopTraverseDeviceNode(PDEVICE_NODE Node, PUNICODE_STRING DeviceInstance)
117 {
118 PDEVICE_OBJECT DeviceObject;
119 PDEVICE_NODE ChildNode;
120
121 if (RtlEqualUnicodeString(&Node->InstancePath,
122 DeviceInstance, TRUE))
123 {
124 ObReferenceObject(Node->PhysicalDeviceObject);
125 return Node->PhysicalDeviceObject;
126 }
127
128 /* Traversal of all children nodes */
129 for (ChildNode = Node->Child;
130 ChildNode != NULL;
131 ChildNode = ChildNode->Sibling)
132 {
133 DeviceObject = IopTraverseDeviceNode(ChildNode, DeviceInstance);
134 if (DeviceObject != NULL)
135 {
136 return DeviceObject;
137 }
138 }
139
140 return NULL;
141 }
142
143
144 static PDEVICE_OBJECT
145 IopGetDeviceObjectFromDeviceInstance(PUNICODE_STRING DeviceInstance)
146 {
147 if (IopRootDeviceNode == NULL)
148 return NULL;
149
150 if (DeviceInstance == NULL ||
151 DeviceInstance->Length == 0)
152 {
153 if (IopRootDeviceNode->PhysicalDeviceObject)
154 {
155 ObReferenceObject(IopRootDeviceNode->PhysicalDeviceObject);
156 return IopRootDeviceNode->PhysicalDeviceObject;
157 }
158 else
159 return NULL;
160 }
161
162 return IopTraverseDeviceNode(IopRootDeviceNode, DeviceInstance);
163
164 }
165
166 static NTSTATUS
167 IopCaptureUnicodeString(PUNICODE_STRING DstName, PUNICODE_STRING SrcName)
168 {
169 NTSTATUS Status = STATUS_SUCCESS;
170 UNICODE_STRING Name;
171
172 Name.Buffer = NULL;
173 _SEH2_TRY
174 {
175 Name.Length = SrcName->Length;
176 Name.MaximumLength = SrcName->MaximumLength;
177 if (Name.Length > Name.MaximumLength)
178 {
179 Status = STATUS_INVALID_PARAMETER;
180 _SEH2_LEAVE;
181 }
182
183 if (Name.MaximumLength)
184 {
185 ProbeForRead(SrcName->Buffer,
186 Name.MaximumLength,
187 sizeof(WCHAR));
188 Name.Buffer = ExAllocatePool(NonPagedPool, Name.MaximumLength);
189 if (Name.Buffer == NULL)
190 {
191 Status = STATUS_INSUFFICIENT_RESOURCES;
192 _SEH2_LEAVE;
193 }
194
195 memcpy(Name.Buffer, SrcName->Buffer, Name.MaximumLength);
196 }
197
198 *DstName = Name;
199 }
200 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
201 {
202 if (Name.Buffer)
203 ExFreePool(Name.Buffer);
204 Status = _SEH2_GetExceptionCode();
205 }
206 _SEH2_END;
207
208 return Status;
209 }
210
211 static NTSTATUS
212 IopGetDeviceProperty(PPLUGPLAY_CONTROL_PROPERTY_DATA PropertyData)
213 {
214 PDEVICE_OBJECT DeviceObject = NULL;
215 NTSTATUS Status;
216 UNICODE_STRING DeviceInstance;
217 ULONG BufferSize;
218 ULONG Property = 0;
219 PVOID Buffer;
220
221 DPRINT("IopGetDeviceProperty() called\n");
222 DPRINT("Device name: %wZ\n", &PropertyData->DeviceInstance);
223
224 Status = IopCaptureUnicodeString(&DeviceInstance, &PropertyData->DeviceInstance);
225 if (!NT_SUCCESS(Status))
226 {
227 return Status;
228 }
229
230 _SEH2_TRY
231 {
232 Property = PropertyData->Property;
233 BufferSize = PropertyData->BufferSize;
234 ProbeForWrite(PropertyData->Buffer,
235 BufferSize,
236 sizeof(UCHAR));
237 }
238 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
239 {
240 ExFreePool(DeviceInstance.Buffer);
241 _SEH2_YIELD(return _SEH2_GetExceptionCode());
242 }
243 _SEH2_END;
244
245 /* Get the device object */
246 DeviceObject = IopGetDeviceObjectFromDeviceInstance(&DeviceInstance);
247 ExFreePool(DeviceInstance.Buffer);
248 if (DeviceObject == NULL)
249 {
250 return STATUS_NO_SUCH_DEVICE;
251 }
252
253 Buffer = ExAllocatePool(NonPagedPool, BufferSize);
254 if (Buffer == NULL)
255 {
256 return STATUS_INSUFFICIENT_RESOURCES;
257 }
258
259 Status = IoGetDeviceProperty(DeviceObject,
260 Property,
261 BufferSize,
262 Buffer,
263 &BufferSize);
264
265 ObDereferenceObject(DeviceObject);
266
267 if (NT_SUCCESS(Status))
268 {
269 _SEH2_TRY
270 {
271 memcpy(PropertyData->Buffer, Buffer, BufferSize);
272 PropertyData->BufferSize = BufferSize;
273 }
274 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
275 {
276 Status = _SEH2_GetExceptionCode();
277 }
278 _SEH2_END;
279 }
280
281 ExFreePool(Buffer);
282 return Status;
283 }
284
285
286 static NTSTATUS
287 IopGetRelatedDevice(PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA RelatedDeviceData)
288 {
289 UNICODE_STRING RootDeviceName;
290 PDEVICE_OBJECT DeviceObject = NULL;
291 PDEVICE_NODE DeviceNode = NULL;
292 PDEVICE_NODE RelatedDeviceNode;
293 UNICODE_STRING TargetDeviceInstance;
294 NTSTATUS Status = STATUS_SUCCESS;
295 ULONG Relation = 0;
296 ULONG MaximumLength = 0;
297
298 DPRINT("IopGetRelatedDevice() called\n");
299 DPRINT("Device name: %wZ\n", &RelatedDeviceData->TargetDeviceInstance);
300
301 Status = IopCaptureUnicodeString(&TargetDeviceInstance, &RelatedDeviceData->TargetDeviceInstance);
302 if (!NT_SUCCESS(Status))
303 {
304 return Status;
305 }
306
307 _SEH2_TRY
308 {
309 Relation = RelatedDeviceData->Relation;
310 MaximumLength = RelatedDeviceData->RelatedDeviceInstanceLength;
311 ProbeForWrite(RelatedDeviceData->RelatedDeviceInstance,
312 MaximumLength,
313 sizeof(WCHAR));
314 }
315 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
316 {
317 ExFreePool(TargetDeviceInstance.Buffer);
318 _SEH2_YIELD(return _SEH2_GetExceptionCode());
319 }
320 _SEH2_END;
321
322 RtlInitUnicodeString(&RootDeviceName,
323 L"HTREE\\ROOT\\0");
324 if (RtlEqualUnicodeString(&TargetDeviceInstance,
325 &RootDeviceName,
326 TRUE))
327 {
328 DeviceNode = IopRootDeviceNode;
329 ExFreePool(TargetDeviceInstance.Buffer);
330 }
331 else
332 {
333 /* Get the device object */
334 DeviceObject = IopGetDeviceObjectFromDeviceInstance(&TargetDeviceInstance);
335 ExFreePool(TargetDeviceInstance.Buffer);
336 if (DeviceObject == NULL)
337 return STATUS_NO_SUCH_DEVICE;
338
339 DeviceNode = ((PEXTENDED_DEVOBJ_EXTENSION)DeviceObject->DeviceObjectExtension)->DeviceNode;
340 }
341
342 switch (Relation)
343 {
344 case PNP_GET_PARENT_DEVICE:
345 RelatedDeviceNode = DeviceNode->Parent;
346 break;
347
348 case PNP_GET_CHILD_DEVICE:
349 RelatedDeviceNode = DeviceNode->Child;
350 break;
351
352 case PNP_GET_SIBLING_DEVICE:
353 RelatedDeviceNode = DeviceNode->Sibling;
354 break;
355
356 default:
357 if (DeviceObject != NULL)
358 {
359 ObDereferenceObject(DeviceObject);
360 }
361
362 return STATUS_INVALID_PARAMETER;
363 }
364
365 if (RelatedDeviceNode == NULL)
366 {
367 if (DeviceObject)
368 {
369 ObDereferenceObject(DeviceObject);
370 }
371
372 return STATUS_NO_SUCH_DEVICE;
373 }
374
375 if (RelatedDeviceNode->InstancePath.Length > MaximumLength)
376 {
377 if (DeviceObject)
378 {
379 ObDereferenceObject(DeviceObject);
380 }
381
382 return STATUS_BUFFER_TOO_SMALL;
383 }
384
385 /* Copy related device instance name */
386 _SEH2_TRY
387 {
388 RtlCopyMemory(RelatedDeviceData->RelatedDeviceInstance,
389 RelatedDeviceNode->InstancePath.Buffer,
390 RelatedDeviceNode->InstancePath.Length);
391 RelatedDeviceData->RelatedDeviceInstanceLength = RelatedDeviceNode->InstancePath.Length;
392 }
393 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
394 {
395 Status = _SEH2_GetExceptionCode();
396 }
397 _SEH2_END;
398
399 if (DeviceObject != NULL)
400 {
401 ObDereferenceObject(DeviceObject);
402 }
403
404 DPRINT("IopGetRelatedDevice() done\n");
405
406 return Status;
407 }
408
409
410 static NTSTATUS
411 IopDeviceStatus(PPLUGPLAY_CONTROL_STATUS_DATA StatusData)
412 {
413 PDEVICE_OBJECT DeviceObject;
414 PDEVICE_NODE DeviceNode;
415 ULONG Operation = 0;
416 ULONG DeviceStatus = 0;
417 ULONG DeviceProblem = 0;
418 UNICODE_STRING DeviceInstance;
419 NTSTATUS Status;
420
421 DPRINT("IopDeviceStatus() called\n");
422
423 Status = IopCaptureUnicodeString(&DeviceInstance, &StatusData->DeviceInstance);
424 if (!NT_SUCCESS(Status))
425 return Status;
426 DPRINT("Device name: '%wZ'\n", &DeviceInstance);
427
428 _SEH2_TRY
429 {
430 Operation = StatusData->Operation;
431 if (Operation == PNP_SET_DEVICE_STATUS)
432 {
433 DeviceStatus = StatusData->DeviceStatus;
434 DeviceProblem = StatusData->DeviceProblem;
435 }
436 }
437 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
438 {
439 if (DeviceInstance.Buffer) ExFreePool(DeviceInstance.Buffer);
440 _SEH2_YIELD(return _SEH2_GetExceptionCode());
441 }
442 _SEH2_END;
443
444 /* Get the device object */
445 DeviceObject = IopGetDeviceObjectFromDeviceInstance(&DeviceInstance);
446 ExFreePool(DeviceInstance.Buffer);
447 if (DeviceObject == NULL)
448 return STATUS_NO_SUCH_DEVICE;
449
450 DeviceNode = IopGetDeviceNode(DeviceObject);
451
452 switch (Operation)
453 {
454 case PNP_GET_DEVICE_STATUS:
455 DPRINT("Get status data\n");
456 DeviceStatus = DeviceNode->Flags;
457 DeviceProblem = DeviceNode->Problem;
458 break;
459
460 case PNP_SET_DEVICE_STATUS:
461 DPRINT("Set status data\n");
462 DeviceNode->Flags = DeviceStatus;
463 DeviceNode->Problem = DeviceProblem;
464 break;
465
466 case PNP_CLEAR_DEVICE_STATUS:
467 DPRINT1("FIXME: Clear status data!\n");
468 break;
469 }
470
471 ObDereferenceObject(DeviceObject);
472
473 if (Operation == PNP_GET_DEVICE_STATUS)
474 {
475 _SEH2_TRY
476 {
477 StatusData->DeviceStatus = DeviceStatus;
478 StatusData->DeviceProblem = DeviceProblem;
479 }
480 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
481 {
482 Status = _SEH2_GetExceptionCode();
483 }
484 _SEH2_END;
485 }
486
487 return Status;
488 }
489
490
491 static NTSTATUS
492 IopGetDeviceDepth(PPLUGPLAY_CONTROL_DEPTH_DATA DepthData)
493 {
494 PDEVICE_OBJECT DeviceObject;
495 PDEVICE_NODE DeviceNode;
496 UNICODE_STRING DeviceInstance;
497 NTSTATUS Status = STATUS_SUCCESS;
498
499 DPRINT("IopGetDeviceDepth() called\n");
500 DPRINT("Device name: %wZ\n", &DepthData->DeviceInstance);
501
502 Status = IopCaptureUnicodeString(&DeviceInstance, &DepthData->DeviceInstance);
503 if (!NT_SUCCESS(Status))
504 {
505 return Status;
506 }
507
508 /* Get the device object */
509 DeviceObject = IopGetDeviceObjectFromDeviceInstance(&DeviceInstance);
510 ExFreePool(DeviceInstance.Buffer);
511 if (DeviceObject == NULL)
512 return STATUS_NO_SUCH_DEVICE;
513
514 DeviceNode = IopGetDeviceNode(DeviceObject);
515
516 _SEH2_TRY
517 {
518 DepthData->Depth = DeviceNode->Level;
519 }
520 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
521 {
522 Status = _SEH2_GetExceptionCode();
523 }
524 _SEH2_END;
525
526 ObDereferenceObject(DeviceObject);
527
528 return Status;
529 }
530
531
532 static NTSTATUS
533 IopResetDevice(PPLUGPLAY_CONTROL_RESET_DEVICE_DATA ResetDeviceData)
534 {
535 PDEVICE_OBJECT DeviceObject;
536 PDEVICE_NODE DeviceNode;
537 NTSTATUS Status = STATUS_SUCCESS;
538 UNICODE_STRING DeviceInstance;
539
540 Status = IopCaptureUnicodeString(&DeviceInstance, &ResetDeviceData->DeviceInstance);
541 if (!NT_SUCCESS(Status))
542 return Status;
543
544 DPRINT("IopResetDevice(%wZ)\n", &DeviceInstance);
545
546 /* Get the device object */
547 DeviceObject = IopGetDeviceObjectFromDeviceInstance(&DeviceInstance);
548 ExFreePool(DeviceInstance.Buffer);
549 if (DeviceObject == NULL)
550 return STATUS_NO_SUCH_DEVICE;
551
552 DeviceNode = IopGetDeviceNode(DeviceObject);
553
554 /* FIXME: we should stop the device, before starting it again */
555
556 /* Start the device */
557 IopDeviceNodeClearFlag(DeviceNode, DNF_DISABLED);
558 Status = IopActionConfigureChildServices(DeviceNode, DeviceNode->Parent);
559
560 if (NT_SUCCESS(Status))
561 Status = IopActionInitChildServices(DeviceNode, DeviceNode->Parent);
562
563 ObDereferenceObject(DeviceObject);
564
565 return Status;
566 }
567
568 /* PUBLIC FUNCTIONS **********************************************************/
569
570 /*
571 * Plug and Play event structure used by NtGetPlugPlayEvent.
572 *
573 * EventGuid
574 * Can be one of the following values:
575 * GUID_HWPROFILE_QUERY_CHANGE
576 * GUID_HWPROFILE_CHANGE_CANCELLED
577 * GUID_HWPROFILE_CHANGE_COMPLETE
578 * GUID_TARGET_DEVICE_QUERY_REMOVE
579 * GUID_TARGET_DEVICE_REMOVE_CANCELLED
580 * GUID_TARGET_DEVICE_REMOVE_COMPLETE
581 * GUID_PNP_CUSTOM_NOTIFICATION
582 * GUID_PNP_POWER_NOTIFICATION
583 * GUID_DEVICE_* (see above)
584 *
585 * EventCategory
586 * Type of the event that happened.
587 *
588 * Result
589 * ?
590 *
591 * Flags
592 * ?
593 *
594 * TotalSize
595 * Size of the event block including the device IDs and other
596 * per category specific fields.
597 */
598
599 /*
600 * NtGetPlugPlayEvent
601 *
602 * Returns one Plug & Play event from a global queue.
603 *
604 * Parameters
605 * Reserved1
606 * Reserved2
607 * Always set to zero.
608 *
609 * Buffer
610 * The buffer that will be filled with the event information on
611 * successful return from the function.
612 *
613 * BufferSize
614 * Size of the buffer pointed by the Buffer parameter. If the
615 * buffer size is not large enough to hold the whole event
616 * information, error STATUS_BUFFER_TOO_SMALL is returned and
617 * the buffer remains untouched.
618 *
619 * Return Values
620 * STATUS_PRIVILEGE_NOT_HELD
621 * STATUS_BUFFER_TOO_SMALL
622 * STATUS_SUCCESS
623 *
624 * Remarks
625 * This function isn't multi-thread safe!
626 *
627 * @implemented
628 */
629 NTSTATUS
630 NTAPI
631 NtGetPlugPlayEvent(IN ULONG Reserved1,
632 IN ULONG Reserved2,
633 OUT PPLUGPLAY_EVENT_BLOCK Buffer,
634 IN ULONG BufferSize)
635 {
636 PPNP_EVENT_ENTRY Entry;
637 NTSTATUS Status;
638
639 DPRINT("NtGetPlugPlayEvent() called\n");
640
641 /* Function can only be called from user-mode */
642 if (KeGetPreviousMode() == KernelMode)
643 {
644 DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n");
645 return STATUS_ACCESS_DENIED;
646 }
647
648 /* Check for Tcb privilege */
649 if (!SeSinglePrivilegeCheck(SeTcbPrivilege,
650 UserMode))
651 {
652 DPRINT1("NtGetPlugPlayEvent: Caller does not hold the SeTcbPrivilege privilege!\n");
653 return STATUS_PRIVILEGE_NOT_HELD;
654 }
655
656 /* Wait for a PnP event */
657 DPRINT("Waiting for pnp notification event\n");
658 Status = KeWaitForSingleObject(&IopPnpNotifyEvent,
659 UserRequest,
660 KernelMode,
661 FALSE,
662 NULL);
663 if (!NT_SUCCESS(Status))
664 {
665 DPRINT1("KeWaitForSingleObject() failed (Status %lx)\n", Status);
666 return Status;
667 }
668
669 /* Get entry from the tail of the queue */
670 Entry = CONTAINING_RECORD(IopPnpEventQueueHead.Blink,
671 PNP_EVENT_ENTRY,
672 ListEntry);
673
674 /* Check the buffer size */
675 if (BufferSize < Entry->Event.TotalSize)
676 {
677 DPRINT1("Buffer is too small for the pnp-event\n");
678 return STATUS_BUFFER_TOO_SMALL;
679 }
680
681 /* Copy event data to the user buffer */
682 memcpy(Buffer,
683 &Entry->Event,
684 Entry->Event.TotalSize);
685
686 DPRINT("NtGetPlugPlayEvent() done\n");
687
688 return STATUS_SUCCESS;
689 }
690
691 /*
692 * NtPlugPlayControl
693 *
694 * A function for doing various Plug & Play operations from user mode.
695 *
696 * Parameters
697 * PlugPlayControlClass
698 * 0x00 Reenumerate device tree
699 *
700 * Buffer points to UNICODE_STRING decribing the instance
701 * path (like "HTREE\ROOT\0" or "Root\ACPI_HAL\0000"). For
702 * more information about instance paths see !devnode command
703 * in kernel debugger or look at "Inside Windows 2000" book,
704 * chapter "Driver Loading, Initialization, and Installation".
705 *
706 * 0x01 Register new device
707 * 0x02 Deregister device
708 * 0x03 Initialize device
709 * 0x04 Start device
710 * 0x06 Query and remove device
711 * 0x07 User response
712 *
713 * Called after processing the message from NtGetPlugPlayEvent.
714 *
715 * 0x08 Generate legacy device
716 * 0x09 Get interface device list
717 * 0x0A Get property data
718 * 0x0B Device class association (Registration)
719 * 0x0C Get related device
720 * 0x0D Get device interface alias
721 * 0x0E Get/set/clear device status
722 * 0x0F Get device depth
723 * 0x10 Query device relations
724 * 0x11 Query target device relation
725 * 0x12 Query conflict list
726 * 0x13 Retrieve dock data
727 * 0x14 Reset device
728 * 0x15 Halt device
729 * 0x16 Get blocked driver data
730 *
731 * Buffer
732 * The buffer contains information that is specific to each control
733 * code. The buffer is read-only.
734 *
735 * BufferSize
736 * Size of the buffer pointed by the Buffer parameter. If the
737 * buffer size specifies incorrect value for specified control
738 * code, error ??? is returned.
739 *
740 * Return Values
741 * STATUS_PRIVILEGE_NOT_HELD
742 * STATUS_SUCCESS
743 * ...
744 *
745 * @unimplemented
746 */
747 NTSTATUS
748 NTAPI
749 NtPlugPlayControl(IN PLUGPLAY_CONTROL_CLASS PlugPlayControlClass,
750 IN OUT PVOID Buffer,
751 IN ULONG BufferLength)
752 {
753 DPRINT("NtPlugPlayControl(%lu %p %lu) called\n",
754 PlugPlayControlClass, Buffer, BufferLength);
755
756 /* Function can only be called from user-mode */
757 if (KeGetPreviousMode() == KernelMode)
758 {
759 DPRINT1("NtGetPlugPlayEvent cannot be called from kernel mode!\n");
760 return STATUS_ACCESS_DENIED;
761 }
762
763 /* Check for Tcb privilege */
764 if (!SeSinglePrivilegeCheck(SeTcbPrivilege,
765 UserMode))
766 {
767 DPRINT1("NtGetPlugPlayEvent: Caller does not hold the SeTcbPrivilege privilege!\n");
768 return STATUS_PRIVILEGE_NOT_HELD;
769 }
770
771 /* Probe the buffer */
772 _SEH2_TRY
773 {
774 ProbeForWrite(Buffer,
775 BufferLength,
776 sizeof(ULONG));
777 }
778 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
779 {
780 _SEH2_YIELD(return _SEH2_GetExceptionCode());
781 }
782 _SEH2_END;
783
784 switch (PlugPlayControlClass)
785 {
786 case PlugPlayControlUserResponse:
787 if (Buffer || BufferLength != 0)
788 return STATUS_INVALID_PARAMETER;
789 return IopRemovePlugPlayEvent();
790
791 case PlugPlayControlProperty:
792 if (!Buffer || BufferLength < sizeof(PLUGPLAY_CONTROL_PROPERTY_DATA))
793 return STATUS_INVALID_PARAMETER;
794 return IopGetDeviceProperty((PPLUGPLAY_CONTROL_PROPERTY_DATA)Buffer);
795
796 case PlugPlayControlGetRelatedDevice:
797 if (!Buffer || BufferLength < sizeof(PLUGPLAY_CONTROL_RELATED_DEVICE_DATA))
798 return STATUS_INVALID_PARAMETER;
799 return IopGetRelatedDevice((PPLUGPLAY_CONTROL_RELATED_DEVICE_DATA)Buffer);
800
801 case PlugPlayControlDeviceStatus:
802 if (!Buffer || BufferLength < sizeof(PLUGPLAY_CONTROL_STATUS_DATA))
803 return STATUS_INVALID_PARAMETER;
804 return IopDeviceStatus((PPLUGPLAY_CONTROL_STATUS_DATA)Buffer);
805
806 case PlugPlayControlGetDeviceDepth:
807 if (!Buffer || BufferLength < sizeof(PLUGPLAY_CONTROL_DEPTH_DATA))
808 return STATUS_INVALID_PARAMETER;
809 return IopGetDeviceDepth((PPLUGPLAY_CONTROL_DEPTH_DATA)Buffer);
810
811 case PlugPlayControlResetDevice:
812 if (!Buffer || BufferLength < sizeof(PLUGPLAY_CONTROL_RESET_DEVICE_DATA))
813 return STATUS_INVALID_PARAMETER;
814 return IopResetDevice((PPLUGPLAY_CONTROL_RESET_DEVICE_DATA)Buffer);
815
816 default:
817 return STATUS_NOT_IMPLEMENTED;
818 }
819
820 return STATUS_NOT_IMPLEMENTED;
821 }