forget update de.rc
[reactos.git] / reactos / ntoskrnl / cm / ntfunc.c
index 8f4a835..51a7160 100644 (file)
@@ -1,20 +1,16 @@
-/*
- * COPYRIGHT:        See COPYING in the top level directory
- * PROJECT:          ReactOS kernel
- * FILE:             ntoskrnl/cm/ntfunc.c
- * PURPOSE:          Ntxxx function for registry access
- * UPDATE HISTORY:
-*/
+/* $Id$
+ *
+ * COPYRIGHT:       See COPYING in the top level directory
+ * PROJECT:         ReactOS kernel
+ * FILE:            ntoskrnl/cm/ntfunc.c
+ * PURPOSE:         Ntxxx function for registry access
+ *
+ * PROGRAMMERS:     No programmer listed.
+ */
 
 /* INCLUDES *****************************************************************/
 
-#define NTOS_MODE_KERNEL
-#include <ntos.h>
-#include <string.h>
-#include <roscfg.h>
-#include <internal/ob.h>
-#include <internal/se.h>
-
+#include <ntoskrnl.h>
 #define NDEBUG
 #include <internal/debug.h>
 
 
 extern POBJECT_TYPE  CmiKeyType;
 extern PREGISTRY_HIVE  CmiVolatileHive;
+extern LIST_ENTRY CmiKeyObjectListHead;
 
 static BOOLEAN CmiRegistryInitialized = FALSE;
 
+LIST_ENTRY CmiCallbackHead;
+FAST_MUTEX CmiCallbackLock;
 
 /* FUNCTIONS ****************************************************************/
 
+/*
+ * @implemented
+ */
+NTSTATUS STDCALL
+CmRegisterCallback(IN PEX_CALLBACK_FUNCTION Function,
+                   IN PVOID Context,
+                   IN OUT PLARGE_INTEGER Cookie)
+{
+  PREGISTRY_CALLBACK Callback;
+
+  PAGED_CODE();
+
+  ASSERT(Function && Cookie);
+
+  Callback = ExAllocatePoolWithTag(PagedPool,
+                                   sizeof(REGISTRY_CALLBACK),
+                                   TAG('C', 'M', 'c', 'b'));
+  if(Callback != NULL)
+  {
+    /* initialize the callback */
+    ExInitializeRundownProtection(&Callback->RundownRef);
+    Callback->Function = Function;
+    Callback->Context = Context;
+    Callback->PendingDelete = FALSE;
+
+    /* add it to the callback list and receive a cookie for the callback */
+    ExAcquireFastMutex(&CmiCallbackLock);
+    /* FIXME - to receive a unique cookie we'll just return the pointer to the
+       callback object */
+    Callback->Cookie.QuadPart = (ULONG_PTR)Callback;
+    InsertTailList(&CmiCallbackHead, &Callback->ListEntry);
+
+    ExReleaseFastMutex(&CmiCallbackLock);
+
+    *Cookie = Callback->Cookie;
+    return STATUS_SUCCESS;
+  }
+
+  return STATUS_INSUFFICIENT_RESOURCES;
+}
+
+
+/*
+ * @implemented
+ */
+NTSTATUS STDCALL
+CmUnRegisterCallback(IN LARGE_INTEGER Cookie)
+{
+  PLIST_ENTRY CurrentEntry;
+
+  PAGED_CODE();
+
+  ExAcquireFastMutex(&CmiCallbackLock);
+
+  for(CurrentEntry = CmiCallbackHead.Flink;
+      CurrentEntry != &CmiCallbackHead;
+      CurrentEntry = CurrentEntry->Flink)
+  {
+    PREGISTRY_CALLBACK CurrentCallback;
+
+    CurrentCallback = CONTAINING_RECORD(CurrentEntry, REGISTRY_CALLBACK, ListEntry);
+    if(CurrentCallback->Cookie.QuadPart == Cookie.QuadPart)
+    {
+      if(!CurrentCallback->PendingDelete)
+      {
+        /* found the callback, don't unlink it from the list yet so we don't screw
+           the calling loop */
+        CurrentCallback->PendingDelete = TRUE;
+        ExReleaseFastMutex(&CmiCallbackLock);
+
+        /* if the callback is currently executing, wait until it finished */
+        ExWaitForRundownProtectionRelease(&CurrentCallback->RundownRef);
+
+        /* time to unlink it. It's now safe because every attempt to acquire a
+           runtime protection on this callback will fail */
+        ExAcquireFastMutex(&CmiCallbackLock);
+        RemoveEntryList(&CurrentCallback->ListEntry);
+        ExReleaseFastMutex(&CmiCallbackLock);
+
+        /* free the callback */
+        ExFreePool(CurrentCallback);
+        return STATUS_SUCCESS;
+      }
+      else
+      {
+        /* pending delete, pretend like it already is deleted */
+        ExReleaseFastMutex(&CmiCallbackLock);
+        return STATUS_UNSUCCESSFUL;
+      }
+    }
+  }
+
+  ExReleaseFastMutex(&CmiCallbackLock);
+
+  return STATUS_UNSUCCESSFUL;
+}
+
+
+NTSTATUS
+CmiCallRegisteredCallbacks(IN REG_NOTIFY_CLASS Argument1,
+                           IN PVOID Argument2)
+{
+  PLIST_ENTRY CurrentEntry;
+  NTSTATUS Status = STATUS_SUCCESS;
+
+  PAGED_CODE();
+
+  ExAcquireFastMutex(&CmiCallbackLock);
+
+  for(CurrentEntry = CmiCallbackHead.Flink;
+      CurrentEntry != &CmiCallbackHead;
+      CurrentEntry = CurrentEntry->Flink)
+  {
+    PREGISTRY_CALLBACK CurrentCallback;
+
+    CurrentCallback = CONTAINING_RECORD(CurrentEntry, REGISTRY_CALLBACK, ListEntry);
+    if(!CurrentCallback->PendingDelete &&
+       ExAcquireRundownProtectionEx(&CurrentCallback->RundownRef, 1))
+    {
+      /* don't hold locks during the callbacks! */
+      ExReleaseFastMutex(&CmiCallbackLock);
+
+      Status = CurrentCallback->Function(CurrentCallback->Context,
+                                         Argument1,
+                                         Argument2);
+
+      ExAcquireFastMutex(&CmiCallbackLock);
+      /* don't release the rundown protection before holding the callback lock
+         so the pointer to the next callback isn't cleared in case this callback
+         get's deleted */
+      ExReleaseRundownProtectionEx(&CurrentCallback->RundownRef, 1);
+      if(!NT_SUCCESS(Status))
+      {
+        /* one callback returned failure, don't call any more callbacks */
+        break;
+      }
+    }
+  }
+
+  ExReleaseFastMutex(&CmiCallbackLock);
+
+  return Status;
+}
+
+
 NTSTATUS STDCALL
 NtCreateKey(OUT PHANDLE KeyHandle,
            IN ACCESS_MASK DesiredAccess,
@@ -40,74 +184,154 @@ NtCreateKey(OUT PHANDLE KeyHandle,
            IN ULONG CreateOptions,
            OUT PULONG Disposition)
 {
-  UNICODE_STRING RemainingPath;
+  UNICODE_STRING RemainingPath = {0};
+  BOOLEAN FreeRemainingPath = TRUE;
+  ULONG LocalDisposition;
   PKEY_OBJECT KeyObject;
-  NTSTATUS Status;
-  PVOID Object;
-  PWSTR End;
+  NTSTATUS Status = STATUS_SUCCESS;
+  PVOID Object = NULL;
   PWSTR Start;
+  UNICODE_STRING ObjectName;
+  OBJECT_CREATE_INFORMATION ObjectCreateInfo;
+  unsigned i;
+  REG_PRE_CREATE_KEY_INFORMATION PreCreateKeyInfo;
+  REG_POST_CREATE_KEY_INFORMATION PostCreateKeyInfo;
+  KPROCESSOR_MODE PreviousMode;
+  UNICODE_STRING CapturedClass = {0};
+  HANDLE hKey;
+
+  PAGED_CODE();
+
+  PreviousMode = ExGetPreviousMode();
+
+  if (PreviousMode != KernelMode)
+  {
+      _SEH_TRY
+      {
+          ProbeForWriteHandle(KeyHandle);
+          if (Disposition != NULL)
+          {
+              ProbeForWriteUlong(Disposition);
+          }
+      }
+      _SEH_HANDLE
+      {
+          Status = _SEH_GetExceptionCode();
+      }
+      _SEH_END;
+      
+      if (!NT_SUCCESS(Status))
+      {
+          return Status;
+      }
+  }
+  
+  if (Class != NULL)
+  {
+      Status = ProbeAndCaptureUnicodeString(&CapturedClass,
+                                            PreviousMode,
+                                            Class);
+      if (!NT_SUCCESS(Status))
+      {
+          return Status;
+      }
+  }
+
+  /* Capture all the info */
+  DPRINT("Capturing Create Info\n");
+  Status = ObpCaptureObjectAttributes(ObjectAttributes,
+                                      PreviousMode,
+                                      CmiKeyType,
+                                      &ObjectCreateInfo,
+                                      &ObjectName);
+  if (!NT_SUCCESS(Status))
+    {
+      DPRINT1("ObpCaptureObjectAttributes() failed (Status %lx)\n", Status);
+      return Status;
+    }
 
-  DPRINT("NtCreateKey (Name %wZ  KeyHandle %x  Root %x)\n",
-        ObjectAttributes->ObjectName,
-        KeyHandle,
-        ObjectAttributes->RootDirectory);
-
-  Status = ObFindObject(ObjectAttributes,
-                       &Object,
-                       &RemainingPath,
-                       CmiKeyType);
+  PostCreateKeyInfo.CompleteName = &ObjectName;
+  PreCreateKeyInfo.CompleteName = &ObjectName;
+  Status = CmiCallRegisteredCallbacks(RegNtPreCreateKey, &PreCreateKeyInfo);
   if (!NT_SUCCESS(Status))
     {
-      return(Status);
+      goto Cleanup;
+    }
+    
+  Status = ObFindObject(&ObjectCreateInfo,
+                        &ObjectName,
+                        (PVOID*)&Object,
+                        &RemainingPath,
+                        CmiKeyType);
+  if (!NT_SUCCESS(Status))
+    {
+      PostCreateKeyInfo.Object = NULL;
+      PostCreateKeyInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+      DPRINT1("CmpFindObject failed, Status: 0x%x\n", Status);
+      goto Cleanup;
     }
 
   DPRINT("RemainingPath %wZ\n", &RemainingPath);
 
-  if ((RemainingPath.Buffer == NULL) || (RemainingPath.Buffer[0] == 0))
+  if (RemainingPath.Length == 0)
     {
       /* Fail if the key has been deleted */
       if (((PKEY_OBJECT) Object)->Flags & KO_MARKED_FOR_DELETE)
        {
-         ObDereferenceObject(Object);
-         RtlFreeUnicodeString(&RemainingPath);
-         return(STATUS_UNSUCCESSFUL);
+          PostCreateKeyInfo.Object = NULL;
+          PostCreateKeyInfo.Status = STATUS_UNSUCCESSFUL;
+          CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+         DPRINT1("Object marked for delete!\n");
+         Status = STATUS_UNSUCCESSFUL;
+         goto Cleanup;
        }
 
-      if (Disposition)
-       *Disposition = REG_OPENED_EXISTING_KEY;
+      Status = ObpCreateHandle(Object,
+                              DesiredAccess,
+                              ObjectCreateInfo.Attributes,
+                              &hKey);
 
-      Status = ObCreateHandle(PsGetCurrentProcess(),
-                             Object,
-                             DesiredAccess,
-                             TRUE,
-                             KeyHandle);
+      if (!NT_SUCCESS(Status))
+        DPRINT1("ObpCreateHandle failed Status 0x%x\n", Status);
 
-      DPRINT("Status %x\n", Status);
-      ObDereferenceObject(Object);
-      RtlFreeUnicodeString(&RemainingPath);
-      return Status;
+      PostCreateKeyInfo.Object = NULL;
+      PostCreateKeyInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+      LocalDisposition = REG_OPENED_EXISTING_KEY;
+      goto SuccessReturn;
     }
 
   /* If RemainingPath contains \ we must return error
-     because NtCreateKey don't create trees */
+     because NtCreateKey doesn't create trees */
   Start = RemainingPath.Buffer;
   if (*Start == L'\\')
     Start++;
 
-  End = wcschr(Start, L'\\');
-  if (End != NULL)
+  for (i = 1; i < RemainingPath.Length / sizeof(WCHAR); i++)
     {
-      ObDereferenceObject(Object);
-      RtlFreeUnicodeString(&RemainingPath);
-      return STATUS_OBJECT_NAME_NOT_FOUND;
+      if (L'\\' == RemainingPath.Buffer[i])
+        {
+          DPRINT("NtCreateKey() doesn't create trees! (found \'\\\' in remaining path: \"%wZ\"!)\n", &RemainingPath);
+
+          PostCreateKeyInfo.Object = NULL;
+          PostCreateKeyInfo.Status = STATUS_OBJECT_NAME_NOT_FOUND;
+          CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+          Status = STATUS_OBJECT_NAME_NOT_FOUND;
+          goto Cleanup;
+        }
     }
 
-  DPRINT("RemainingPath %S  ParentObject %x\n", RemainingPath.Buffer, Object);
+  DPRINT("RemainingPath %S  ParentObject 0x%p\n", RemainingPath.Buffer, Object);
 
-  Status = ObCreateObject(ExGetPreviousMode(),
+  Status = ObCreateObject(PreviousMode,
                          CmiKeyType,
                          NULL,
-                         ExGetPreviousMode(),
+                         PreviousMode,
                          NULL,
                          sizeof(KEY_OBJECT),
                          0,
@@ -115,7 +339,12 @@ NtCreateKey(OUT PHANDLE KeyHandle,
                          (PVOID*)&KeyObject);
   if (!NT_SUCCESS(Status))
     {
-      return(Status);
+      DPRINT1("ObCreateObject() failed!\n");
+      PostCreateKeyInfo.Object = NULL;
+      PostCreateKeyInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+      goto Cleanup;
     }
 
   Status = ObInsertObject((PVOID)KeyObject,
@@ -123,12 +352,17 @@ NtCreateKey(OUT PHANDLE KeyHandle,
                          DesiredAccess,
                          0,
                          NULL,
-                         KeyHandle);
+                         &hKey);
   if (!NT_SUCCESS(Status))
     {
       ObDereferenceObject(KeyObject);
-      RtlFreeUnicodeString(&RemainingPath);
-      return(Status);
+      DPRINT1("ObInsertObject() failed!\n");
+
+      PostCreateKeyInfo.Object = NULL;
+      PostCreateKeyInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+      goto Cleanup;
     }
 
   KeyObject->ParentKey = Object;
@@ -145,7 +379,9 @@ NtCreateKey(OUT PHANDLE KeyHandle,
 
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
+
+  InsertTailList(&CmiKeyObjectListHead, &KeyObject->ListEntry);
 
   /* add key to subkeys of parent if needed */
   Status = CmiAddSubKey(KeyObject->RegistryHive,
@@ -153,29 +389,32 @@ NtCreateKey(OUT PHANDLE KeyHandle,
                        KeyObject,
                        &RemainingPath,
                        TitleIndex,
-                       Class,
+                       &CapturedClass,
                        CreateOptions);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("CmiAddSubKey() failed (Status %lx)\n", Status);
+      DPRINT1("CmiAddSubKey() failed (Status %lx)\n", Status);
       /* Release hive lock */
-      ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
       ObDereferenceObject(KeyObject);
-      ObDereferenceObject(Object);
-      RtlFreeUnicodeString(&RemainingPath);
-      return STATUS_UNSUCCESSFUL;
+
+      PostCreateKeyInfo.Object = NULL;
+      PostCreateKeyInfo.Status = STATUS_UNSUCCESSFUL;
+      CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
+
+      Status = STATUS_UNSUCCESSFUL;
+      goto Cleanup;
     }
 
   if (Start == RemainingPath.Buffer)
     {
       KeyObject->Name = RemainingPath;
+      FreeRemainingPath = FALSE;
     }
   else
     {
-      RtlCreateUnicodeString(&KeyObject->Name,
-                            Start);
-      RtlFreeUnicodeString(&RemainingPath);
+      RtlpCreateUnicodeString(&KeyObject->Name, Start, NonPagedPool);
     }
 
   if (KeyObject->RegistryHive == KeyObject->ParentKey->RegistryHive)
@@ -189,10 +428,7 @@ NtCreateKey(OUT PHANDLE KeyHandle,
       KeyObject->KeyCell->SecurityKeyOffset = -1;
       /* This key must remain in memory unless it is deleted
         or file is unloaded */
-      ObReferenceObjectByPointer(KeyObject,
-                                STANDARD_RIGHTS_REQUIRED,
-                                NULL,
-                                UserMode);
+      ObReferenceObject(KeyObject);
     }
 
   CmiAddKeyToList(KeyObject->ParentKey, KeyObject);
@@ -200,16 +436,42 @@ NtCreateKey(OUT PHANDLE KeyHandle,
   VERIFY_KEY_OBJECT(KeyObject);
 
   /* Release hive lock */
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
-  ObDereferenceObject(KeyObject);
-  ObDereferenceObject(Object);
-
-  if (Disposition)
-    *Disposition = REG_CREATED_NEW_KEY;
+  PostCreateKeyInfo.Object = KeyObject;
+  PostCreateKeyInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostCreateKey, &PostCreateKeyInfo);
 
   CmiSyncHives();
+  
+  LocalDisposition = REG_CREATED_NEW_KEY;
+
+SuccessReturn:
+  _SEH_TRY
+  {
+      *KeyHandle = hKey;
+      if (Disposition != NULL)
+      {
+          *Disposition = LocalDisposition;
+      }
+  }
+  _SEH_HANDLE
+  {
+      Status = _SEH_GetExceptionCode();
+  }
+  _SEH_END;
+
+Cleanup:
+  ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+  if (Class != NULL)
+  {
+    ReleaseCapturedUnicodeString(&CapturedClass,
+                                 PreviousMode);
+  }
+  if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
+  if (FreeRemainingPath) RtlFreeUnicodeString(&RemainingPath);
+  if (Object != NULL) ObDereferenceObject(Object);
 
   return Status;
 }
@@ -218,26 +480,45 @@ NtCreateKey(OUT PHANDLE KeyHandle,
 NTSTATUS STDCALL
 NtDeleteKey(IN HANDLE KeyHandle)
 {
+  KPROCESSOR_MODE PreviousMode;
   PKEY_OBJECT KeyObject;
   NTSTATUS Status;
+  REG_DELETE_KEY_INFORMATION DeleteKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
+
+  PAGED_CODE();
 
-  DPRINT("KeyHandle %x\n", KeyHandle);
+  DPRINT("NtDeleteKey(KeyHandle 0x%p) called\n", KeyHandle);
+
+  PreviousMode = ExGetPreviousMode();
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
-                                    KEY_WRITE,
+                                    DELETE,
                                     CmiKeyType,
-                                    UserMode,
+                                    PreviousMode,
                                     (PVOID *)&KeyObject,
                                     NULL);
   if (!NT_SUCCESS(Status))
     {
-      return(Status);
+      DPRINT1("ObReferenceObjectByHandle() failed (Status %lx)\n", Status);
+      return Status;
+    }
+
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  DeleteKeyInfo.Object = (PVOID)KeyObject;
+  Status = CmiCallRegisteredCallbacks(RegNtPreSetValueKey, &DeleteKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      PostOperationInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtDeleteKey, &PostOperationInfo);
+      ObDereferenceObject(KeyObject);
+      return Status;
     }
 
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -254,17 +535,25 @@ NtDeleteKey(IN HANDLE KeyHandle)
     }
 
   /* Release hive lock */
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
   DPRINT("PointerCount %lu\n", ObGetObjectPointerCount((PVOID)KeyObject));
 
-  /* Dereference the object */
+  /* Remove the keep-alive reference */
   ObDereferenceObject(KeyObject);
-  if(KeyObject->RegistryHive != KeyObject->ParentKey->RegistryHive)
+
+  if (KeyObject->RegistryHive != KeyObject->ParentKey->RegistryHive)
     ObDereferenceObject(KeyObject);
 
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostDeleteKey, &PostOperationInfo);
+
+  /* Dereference the object */
+  ObDereferenceObject(KeyObject);
+
   DPRINT("PointerCount %lu\n", ObGetObjectPointerCount((PVOID)KeyObject));
+  DPRINT("HandleCount %lu\n", ObGetObjectHandleCount((PVOID)KeyObject));
 
   /*
    * Note:
@@ -273,7 +562,7 @@ NtDeleteKey(IN HANDLE KeyHandle)
    * have been released.
    */
 
-  return(Status);
+  return Status;
 }
 
 
@@ -294,10 +583,17 @@ NtEnumerateKey(IN HANDLE KeyHandle,
   PKEY_NODE_INFORMATION  NodeInformation;
   PKEY_FULL_INFORMATION  FullInformation;
   PDATA_CELL ClassCell;
-  ULONG NameSize;
+  ULONG NameSize, ClassSize;
+  KPROCESSOR_MODE PreviousMode;
   NTSTATUS Status;
+  REG_ENUMERATE_KEY_INFORMATION EnumerateKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
+
+  PAGED_CODE();
 
-  DPRINT("KH %x  I %d  KIC %x KI %x  L %d  RL %x\n",
+  PreviousMode = ExGetPreviousMode();
+
+  DPRINT("KH 0x%p  I %d  KIC %x KI 0x%p  L %d  RL 0x%p\n",
         KeyHandle,
         Index,
         KeyInformationClass,
@@ -309,7 +605,7 @@ NtEnumerateKey(IN HANDLE KeyHandle,
   Status = ObReferenceObjectByHandle(KeyHandle,
                KEY_ENUMERATE_SUB_KEYS,
                CmiKeyType,
-               UserMode,
+               PreviousMode,
                (PVOID *) &KeyObject,
                NULL);
   if (!NT_SUCCESS(Status))
@@ -318,9 +614,23 @@ NtEnumerateKey(IN HANDLE KeyHandle,
       return(Status);
     }
 
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  EnumerateKeyInfo.Object = (PVOID)KeyObject;
+  EnumerateKeyInfo.Index = Index;
+  EnumerateKeyInfo.KeyInformationClass = KeyInformationClass;
+  EnumerateKeyInfo.Length = Length;
+  EnumerateKeyInfo.ResultLength = ResultLength;
+
+  Status = CmiCallRegisteredCallbacks(RegNtEnumerateKey, &EnumerateKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject(KeyObject);
+      return Status;
+    }
+
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceSharedLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -333,8 +643,10 @@ NtEnumerateKey(IN HANDLE KeyHandle,
   /* Check for hightest possible sub key index */
   if (Index >= KeyCell->NumberOfSubKeys + KeyObject->NumberOfSubKeys)
     {
-      ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
+      PostOperationInfo.Status = STATUS_NO_MORE_ENTRIES;
+      CmiCallRegisteredCallbacks(RegNtPostDeleteKey, &PostOperationInfo);
       ObDereferenceObject(KeyObject);
       DPRINT("No more volatile entries\n");
       return STATUS_NO_MORE_ENTRIES;
@@ -352,8 +664,7 @@ NtEnumerateKey(IN HANDLE KeyHandle,
       for (i = 0; i < KeyObject->NumberOfSubKeys; i++)
        {
          CurKey = KeyObject->SubKeys[i];
-         if (CurKey->RegistryHive == CmiVolatileHive ||
-             CurKey->RegistryHive != RegistryHive)
+         if (CurKey->RegistryHive != RegistryHive)
            {
              if (j == Index)
                break;
@@ -363,8 +674,10 @@ NtEnumerateKey(IN HANDLE KeyHandle,
 
       if (i >= KeyObject->NumberOfSubKeys)
        {
-         ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+         ExReleaseResourceLite(&CmiRegistryLock);
          KeLeaveCriticalRegion();
+          PostOperationInfo.Status = STATUS_NO_MORE_ENTRIES;
+          CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
          ObDereferenceObject(KeyObject);
          DPRINT("No more non-volatile entries\n");
          return STATUS_NO_MORE_ENTRIES;
@@ -377,8 +690,10 @@ NtEnumerateKey(IN HANDLE KeyHandle,
     {
       if (KeyCell->HashTableOffset == (BLOCK_OFFSET)-1)
        {
-         ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+         ExReleaseResourceLite(&CmiRegistryLock);
          KeLeaveCriticalRegion();
+          PostOperationInfo.Status = STATUS_NO_MORE_ENTRIES;
+          CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
          ObDereferenceObject(KeyObject);
          return STATUS_NO_MORE_ENTRIES;
        }
@@ -387,8 +702,10 @@ NtEnumerateKey(IN HANDLE KeyHandle,
       if (HashTableBlock == NULL)
        {
          DPRINT("CmiGetBlock() failed\n");
-         ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+         ExReleaseResourceLite(&CmiRegistryLock);
          KeLeaveCriticalRegion();
+          PostOperationInfo.Status = STATUS_UNSUCCESSFUL;
+          CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
          ObDereferenceObject(KeyObject);
          return STATUS_UNSUCCESSFUL;
        }
@@ -400,11 +717,13 @@ NtEnumerateKey(IN HANDLE KeyHandle,
 
   if (SubKeyCell == NULL)
     {
-      ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
+      PostOperationInfo.Status = STATUS_NO_MORE_ENTRIES;
+      CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
       ObDereferenceObject(KeyObject);
       DPRINT("No more entries\n");
-      return(STATUS_NO_MORE_ENTRIES);
+      return STATUS_NO_MORE_ENTRIES;
     }
 
   Status = STATUS_SUCCESS;
@@ -412,16 +731,30 @@ NtEnumerateKey(IN HANDLE KeyHandle,
     {
       case KeyBasicInformation:
        /* Check size of buffer */
-       NameSize = SubKeyCell->NameSize;
-       if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
+       if (SubKeyObject != NULL)
          {
-           NameSize *= sizeof(WCHAR);
+           NameSize = SubKeyObject->Name.Length;
+         }
+       else
+         {
+           NameSize = SubKeyCell->NameSize;
+           if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
+             {
+               NameSize *= sizeof(WCHAR);
+             }
          }
-       *ResultLength = sizeof(KEY_BASIC_INFORMATION) + NameSize;
 
-       if (Length < *ResultLength)
+       *ResultLength = FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]) + NameSize;
+
+       /*
+        * NOTE: It's perfetly valid to call NtEnumerateKey to get
+         * all the information but name. Actually the NT4 sound
+         * framework does that while querying parameters from registry.
+         * -- Filip Navara, 19/07/2004
+         */
+       if (Length < FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]))
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -432,27 +765,32 @@ NtEnumerateKey(IN HANDLE KeyHandle,
            BasicInformation->TitleIndex = Index;
            BasicInformation->NameLength = NameSize;
 
+           if (Length - FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]) < NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            if (SubKeyObject != NULL)
              {
-               BasicInformation->NameLength = SubKeyObject->Name.Length;
                RtlCopyMemory(BasicInformation->Name,
                              SubKeyObject->Name.Buffer,
-                             SubKeyObject->Name.Length);
+                             NameSize);
              }
            else
              {
-               BasicInformation->NameLength = NameSize;
                if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
                  {
                    CmiCopyPackedName(BasicInformation->Name,
                                      SubKeyCell->Name,
-                                     SubKeyCell->NameSize);
+                                     NameSize / sizeof(WCHAR));
                  }
                else
                  {
                    RtlCopyMemory(BasicInformation->Name,
                                  SubKeyCell->Name,
-                                 SubKeyCell->NameSize);
+                                 NameSize);
                  }
              }
          }
@@ -460,20 +798,26 @@ NtEnumerateKey(IN HANDLE KeyHandle,
 
       case KeyNodeInformation:
        /* Check size of buffer */
-       if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
+       if (SubKeyObject != NULL)
          {
-           NameSize = SubKeyCell->NameSize * sizeof(WCHAR);
+           NameSize = SubKeyObject->Name.Length;
          }
        else
          {
            NameSize = SubKeyCell->NameSize;
+           if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
+             {
+               NameSize *= sizeof(WCHAR);
+             }
          }
-       *ResultLength = sizeof(KEY_NODE_INFORMATION) +
-         NameSize + SubKeyCell->ClassSize;
+       ClassSize = SubKeyCell->ClassSize;
 
-       if (Length < *ResultLength)
+       *ResultLength = FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) +
+         NameSize + ClassSize;
+
+       if (Length < FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]))
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -484,51 +828,68 @@ NtEnumerateKey(IN HANDLE KeyHandle,
            NodeInformation->TitleIndex = Index;
            NodeInformation->ClassOffset = sizeof(KEY_NODE_INFORMATION) + NameSize;
            NodeInformation->ClassLength = SubKeyCell->ClassSize;
+           NodeInformation->NameLength = NameSize;
+
+           if (Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) < NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]);
+               ClassSize = 0;
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+           else if (Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) -
+                    NameSize < ClassSize)
+             {
+               ClassSize = Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) -
+                           NameSize;
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
 
            if (SubKeyObject != NULL)
              {
-               NodeInformation->NameLength = SubKeyObject->Name.Length;
                RtlCopyMemory(NodeInformation->Name,
                              SubKeyObject->Name.Buffer,
-                             SubKeyObject->Name.Length);
+                             NameSize);
              }
            else
              {
-               NodeInformation->NameLength = NameSize;
                if (SubKeyCell->Flags & REG_KEY_NAME_PACKED)
                  {
                    CmiCopyPackedName(NodeInformation->Name,
                                      SubKeyCell->Name,
-                                     SubKeyCell->NameSize);
+                                     NameSize / sizeof(WCHAR));
                  }
                else
                  {
                    RtlCopyMemory(NodeInformation->Name,
                                  SubKeyCell->Name,
-                                 SubKeyCell->NameSize);
+                                 NameSize);
                  }
              }
 
-           if (SubKeyCell->ClassSize != 0)
+           if (ClassSize != 0)
              {
                ClassCell = CmiGetCell (KeyObject->RegistryHive,
                                        SubKeyCell->ClassNameOffset,
                                        NULL);
                RtlCopyMemory (NodeInformation->Name + SubKeyCell->NameSize,
                               ClassCell->Data,
-                              SubKeyCell->ClassSize);
+                              ClassSize);
              }
          }
        break;
 
       case KeyFullInformation:
-       /* Check size of buffer */
-       *ResultLength = sizeof(KEY_FULL_INFORMATION) +
-         SubKeyCell->ClassSize;
+       ClassSize = SubKeyCell->ClassSize;
 
-       if (Length < *ResultLength)
+       *ResultLength = FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]) +
+         ClassSize;
+
+       /* Check size of buffer */
+       if (Length < FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]))
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -548,14 +909,22 @@ NtEnumerateKey(IN HANDLE KeyHandle,
              CmiGetMaxValueNameLength(RegistryHive, SubKeyCell);
            FullInformation->MaxValueDataLen =
              CmiGetMaxValueDataLength(RegistryHive, SubKeyCell);
-           if (SubKeyCell->ClassSize != 0)
+
+           if (Length - FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]) < ClassSize)
+             {
+               ClassSize = Length - FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
+           if (ClassSize != 0)
              {
                ClassCell = CmiGetCell (KeyObject->RegistryHive,
                                        SubKeyCell->ClassNameOffset,
                                        NULL);
                RtlCopyMemory (FullInformation->Class,
                               ClassCell->Data,
-                              SubKeyCell->ClassSize);
+                              ClassSize);
              }
          }
        break;
@@ -565,8 +934,12 @@ NtEnumerateKey(IN HANDLE KeyHandle,
        break;
     }
 
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
+
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostEnumerateKey, &PostOperationInfo);
+
   ObDereferenceObject(KeyObject);
 
   DPRINT("Returning status %x\n", Status);
@@ -589,12 +962,14 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
   PKEY_CELL  KeyCell;
   PVALUE_CELL  ValueCell;
   PDATA_CELL  DataCell;
-  ULONG NameSize;
+  ULONG NameSize, DataSize;
   PKEY_VALUE_BASIC_INFORMATION  ValueBasicInformation;
   PKEY_VALUE_PARTIAL_INFORMATION  ValuePartialInformation;
   PKEY_VALUE_FULL_INFORMATION  ValueFullInformation;
 
-  DPRINT("KH %x  I %d  KVIC %x  KVI %x  L %d  RL %x\n",
+  PAGED_CODE();
+
+  DPRINT("KH 0x%p  I %d  KVIC %x  KVI 0x%p  L %d  RL 0x%p\n",
         KeyHandle,
         Index,
         KeyValueInformationClass,
@@ -606,7 +981,7 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
   Status = ObReferenceObjectByHandle(KeyHandle,
                KEY_QUERY_VALUE,
                CmiKeyType,
-               UserMode,
+               ExGetPreviousMode(),
                (PVOID *) &KeyObject,
                NULL);
 
@@ -617,7 +992,7 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
 
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceSharedLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -633,7 +1008,7 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
 
   if (!NT_SUCCESS(Status))
     {
-      ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
       ObDereferenceObject(KeyObject);
       return Status;
@@ -646,26 +1021,37 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
         case KeyValueBasicInformation:
          NameSize = ValueCell->NameSize;
          if (ValueCell->Flags & REG_VALUE_NAME_PACKED)
-            {
+           {
              NameSize *= sizeof(WCHAR);
            }
-          *ResultLength = sizeof(KEY_VALUE_BASIC_INFORMATION) + NameSize;
-          if (Length < *ResultLength)
+
+          *ResultLength = FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]) + NameSize;
+
+          if (Length < FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]))
             {
-              Status = STATUS_BUFFER_OVERFLOW;
+              Status = STATUS_BUFFER_TOO_SMALL;
             }
           else
             {
-              ValueBasicInformation = (PKEY_VALUE_BASIC_INFORMATION) 
+              ValueBasicInformation = (PKEY_VALUE_BASIC_INFORMATION)
                 KeyValueInformation;
               ValueBasicInformation->TitleIndex = 0;
               ValueBasicInformation->Type = ValueCell->DataType;
              ValueBasicInformation->NameLength = NameSize;
+
+             if (Length - FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]) <
+                 NameSize)
+               {
+                 NameSize = Length - FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]);
+                 Status = STATUS_BUFFER_OVERFLOW;
+                 CHECKPOINT;
+               }
+
               if (ValueCell->Flags & REG_VALUE_NAME_PACKED)
                 {
                   CmiCopyPackedName(ValueBasicInformation->Name,
                                     ValueCell->Name,
-                                    ValueCell->NameSize);
+                                    NameSize / sizeof(WCHAR));
                 }
               else
                 {
@@ -677,11 +1063,14 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
           break;
 
         case KeyValuePartialInformation:
-          *ResultLength = sizeof(KEY_VALUE_PARTIAL_INFORMATION) + 
-            (ValueCell->DataSize & REG_DATA_SIZE_MASK);
-          if (Length < *ResultLength)
+          DataSize = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+          *ResultLength = FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]) +
+            DataSize;
+
+          if (Length < FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]))
             {
-              Status = STATUS_BUFFER_OVERFLOW;
+              Status = STATUS_BUFFER_TOO_SMALL;
             }
           else
             {
@@ -690,18 +1079,27 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
               ValuePartialInformation->TitleIndex = 0;
               ValuePartialInformation->Type = ValueCell->DataType;
               ValuePartialInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+              if (Length - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]) <
+                  DataSize)
+                {
+                  DataSize = Length - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]);
+                  Status = STATUS_BUFFER_OVERFLOW;
+                  CHECKPOINT;
+                }
+
               if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET))
               {
                 DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
-                RtlCopyMemory(ValuePartialInformation->Data, 
+                RtlCopyMemory(ValuePartialInformation->Data,
                   DataCell->Data,
-                  ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                  DataSize);
               }
               else
               {
-                RtlCopyMemory(ValuePartialInformation->Data, 
-                  &ValueCell->DataOffset, 
-                  ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                RtlCopyMemory(ValuePartialInformation->Data,
+                  &ValueCell->DataOffset,
+                  DataSize);
               }
             }
           break;
@@ -712,51 +1110,69 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
             {
              NameSize *= sizeof(WCHAR);
            }
-          *ResultLength = sizeof(KEY_VALUE_FULL_INFORMATION) + 
-             NameSize + (ValueCell->DataSize & REG_DATA_SIZE_MASK);
-          if (Length < *ResultLength)
+         DataSize = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+          *ResultLength = ROUND_UP(FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
+                          Name[0]) + NameSize, sizeof(PVOID)) + DataSize;
+
+          if (Length < FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]))
             {
-              Status = STATUS_BUFFER_OVERFLOW;
+              Status = STATUS_BUFFER_TOO_SMALL;
             }
           else
             {
-              ValueFullInformation = (PKEY_VALUE_FULL_INFORMATION) 
+              ValueFullInformation = (PKEY_VALUE_FULL_INFORMATION)
                 KeyValueInformation;
               ValueFullInformation->TitleIndex = 0;
               ValueFullInformation->Type = ValueCell->DataType;
               ValueFullInformation->NameLength = NameSize;
+              ValueFullInformation->DataOffset =
+                (ULONG_PTR)ValueFullInformation->Name -
+                (ULONG_PTR)ValueFullInformation +
+                ValueFullInformation->NameLength;
+              ValueFullInformation->DataOffset =
+                  ROUND_UP(ValueFullInformation->DataOffset, sizeof(PVOID));
+              ValueFullInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+              if (Length < ValueFullInformation->DataOffset)
+               {
+                 NameSize = Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]);
+                 DataSize = 0;
+                 Status = STATUS_BUFFER_OVERFLOW;
+                 CHECKPOINT;
+               }
+              else if (Length - ValueFullInformation->DataOffset < DataSize) 
+               {
+                 DataSize = Length - ValueFullInformation->DataOffset;
+                 Status = STATUS_BUFFER_OVERFLOW;
+                 CHECKPOINT;
+               }
+
               if (ValueCell->Flags & REG_VALUE_NAME_PACKED)
                 {
                   CmiCopyPackedName(ValueFullInformation->Name,
                                    ValueCell->Name,
-                                   ValueCell->NameSize);
+                                   NameSize / sizeof(WCHAR));
                 }
               else
                 {
                   RtlCopyMemory(ValueFullInformation->Name,
                                ValueCell->Name,
-                               ValueCell->NameSize);
+                               NameSize);
                 }
-              ValueFullInformation->DataOffset = 
-                (ULONG)ValueFullInformation->Name - (ULONG)ValueFullInformation +
-                ValueFullInformation->NameLength;
-              ValueFullInformation->DataOffset =
-                  ROUND_UP(ValueFullInformation->DataOffset, sizeof(PVOID));
-              ValueFullInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
               if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET))
                 {
                   DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
                   RtlCopyMemory((PCHAR) ValueFullInformation
                     + ValueFullInformation->DataOffset,
-                    DataCell->Data,
-                    ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                    DataCell->Data, DataSize);
                 }
               else
                 {
                   RtlCopyMemory((PCHAR) ValueFullInformation
                     + ValueFullInformation->DataOffset,
-                    &ValueCell->DataOffset,
-                    ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                    &ValueCell->DataOffset, DataSize);
                 }
             }
           break;
@@ -771,7 +1187,7 @@ NtEnumerateValueKey(IN HANDLE KeyHandle,
       Status = STATUS_UNSUCCESSFUL;
     }
 
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
   ObDereferenceObject(KeyObject);
 
@@ -785,14 +1201,19 @@ NtFlushKey(IN HANDLE KeyHandle)
   NTSTATUS Status;
   PKEY_OBJECT  KeyObject;
   PREGISTRY_HIVE  RegistryHive;
+  KPROCESSOR_MODE  PreviousMode;
+
+  PAGED_CODE();
 
   DPRINT("NtFlushKey (KeyHandle %lx) called\n", KeyHandle);
 
+  PreviousMode = ExGetPreviousMode();
+
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
-                                    KEY_QUERY_VALUE,
+                                    0,
                                     CmiKeyType,
-                                    UserMode,
+                                    PreviousMode,
                                     (PVOID *)&KeyObject,
                                     NULL);
   if (!NT_SUCCESS(Status))
@@ -806,8 +1227,7 @@ NtFlushKey(IN HANDLE KeyHandle)
 
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite(&RegistryHive->HiveResource,
-                                TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   if (IsNoFileHive(RegistryHive))
     {
@@ -819,7 +1239,7 @@ NtFlushKey(IN HANDLE KeyHandle)
       Status = CmiFlushRegistryHive(RegistryHive);
     }
 
-  ExReleaseResourceLite(&RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
   ObDereferenceObject(KeyObject);
@@ -834,23 +1254,87 @@ NtOpenKey(OUT PHANDLE KeyHandle,
          IN POBJECT_ATTRIBUTES ObjectAttributes)
 {
   UNICODE_STRING RemainingPath;
-  NTSTATUS Status;
-  PVOID Object;
-
-  DPRINT("NtOpenKey(KH %x  DA %x  OA %x  OA->ON '%wZ'\n",
+  KPROCESSOR_MODE PreviousMode;
+  PVOID Object = NULL;
+  HANDLE hKey = NULL;
+  NTSTATUS Status = STATUS_SUCCESS;
+  UNICODE_STRING ObjectName;
+  OBJECT_CREATE_INFORMATION ObjectCreateInfo;
+  REG_PRE_OPEN_KEY_INFORMATION PreOpenKeyInfo;
+  REG_POST_OPEN_KEY_INFORMATION PostOpenKeyInfo;
+
+  PAGED_CODE();
+
+  DPRINT("NtOpenKey(KH 0x%p  DA %x  OA 0x%p  OA->ON '%wZ'\n",
         KeyHandle,
         DesiredAccess,
         ObjectAttributes,
         ObjectAttributes ? ObjectAttributes->ObjectName : NULL);
 
+  /* Check place for result handle, if it's null - return immediately */
+  if (KeyHandle == NULL)
+         return(STATUS_INVALID_PARAMETER);
+
+  PreviousMode = ExGetPreviousMode();
+
+  if(PreviousMode != KernelMode)
+  {
+    _SEH_TRY
+    {
+      ProbeForWriteHandle(KeyHandle);
+    }
+    _SEH_HANDLE
+    {
+      Status = _SEH_GetExceptionCode();
+    }
+    _SEH_END;
+
+    if(!NT_SUCCESS(Status))
+    {
+      return Status;
+    }
+  }
+
+  /* WINE checks for the length also */
+  /*if (ObjectAttributes->ObjectName->Length > MAX_NAME_LENGTH)
+         return(STATUS_BUFFER_OVERFLOW);*/
+
+      /* Capture all the info */
+   DPRINT("Capturing Create Info\n");
+   Status = ObpCaptureObjectAttributes(ObjectAttributes,
+                                       PreviousMode,
+                                       CmiKeyType,
+                                       &ObjectCreateInfo,
+                                       &ObjectName);
+   if (!NT_SUCCESS(Status))
+     {
+       DPRINT("ObpCaptureObjectAttributes() failed (Status %lx)\n", Status);
+       return Status;
+     }
+
+  PostOpenKeyInfo.CompleteName = &ObjectName;
+  PreOpenKeyInfo.CompleteName = &ObjectName;
+  Status = CmiCallRegisteredCallbacks(RegNtPreOpenKey, &PreOpenKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+      if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
+      return Status;
+    }
+
+
   RemainingPath.Buffer = NULL;
-  Status = ObFindObject(ObjectAttributes,
-                       &Object,
-                       &RemainingPath,
-                       CmiKeyType);
+
+  Status = ObFindObject(&ObjectCreateInfo,
+                        &ObjectName,
+                       (PVOID*)&Object,
+                        &RemainingPath,
+                        CmiKeyType);
   if (!NT_SUCCESS(Status))
     {
-      return(Status);
+      DPRINT("CmpFindObject() returned 0x%08lx\n", Status);
+      Status = STATUS_INVALID_HANDLE; /* Because ObFindObject returns STATUS_UNSUCCESSFUL */
+      goto openkey_cleanup;
     }
 
   VERIFY_KEY_OBJECT((PKEY_OBJECT) Object);
@@ -859,9 +1343,9 @@ NtOpenKey(OUT PHANDLE KeyHandle,
 
   if ((RemainingPath.Buffer != NULL) && (RemainingPath.Buffer[0] != 0))
     {
-      ObDereferenceObject(Object);
       RtlFreeUnicodeString(&RemainingPath);
-      return STATUS_OBJECT_NAME_NOT_FOUND;
+      Status = STATUS_OBJECT_NAME_NOT_FOUND;
+      goto openkey_cleanup;
     }
 
   RtlFreeUnicodeString(&RemainingPath);
@@ -869,23 +1353,42 @@ NtOpenKey(OUT PHANDLE KeyHandle,
   /* Fail if the key has been deleted */
   if (((PKEY_OBJECT)Object)->Flags & KO_MARKED_FOR_DELETE)
     {
-      ObDereferenceObject(Object);
-      return(STATUS_UNSUCCESSFUL);
+      Status = STATUS_UNSUCCESSFUL;
+      goto openkey_cleanup;
     }
 
-  Status = ObCreateHandle(PsGetCurrentProcess(),
-                         Object,
-                         DesiredAccess,
-                         TRUE,
-                         KeyHandle);
-  ObDereferenceObject(Object);
+  Status = ObpCreateHandle(Object,
+                          DesiredAccess,
+                          ObjectCreateInfo.Attributes,
+                          &hKey);
 
-  if (!NT_SUCCESS(Status))
+openkey_cleanup:
+
+  ObpReleaseCapturedAttributes(&ObjectCreateInfo);
+  PostOpenKeyInfo.Object = NT_SUCCESS(Status) ? (PVOID)Object : NULL;
+  PostOpenKeyInfo.Status = Status;
+  CmiCallRegisteredCallbacks (RegNtPostOpenKey, &PostOpenKeyInfo);
+  if (ObjectName.Buffer) ExFreePool(ObjectName.Buffer);
+
+  if (Object)
     {
-      return(Status);
+      ObDereferenceObject(Object);
     }
 
-  return(STATUS_SUCCESS);
+  if (NT_SUCCESS(Status))
+  {
+    _SEH_TRY
+    {
+      *KeyHandle = hKey;
+    }
+    _SEH_HANDLE
+    {
+      Status = _SEH_GetExceptionCode();
+    }
+    _SEH_END;
+  }
+
+  return Status;
 }
 
 
@@ -903,9 +1406,14 @@ NtQueryKey(IN HANDLE KeyHandle,
   PDATA_CELL ClassCell;
   PKEY_OBJECT KeyObject;
   PKEY_CELL KeyCell;
+  ULONG NameSize, ClassSize;
   NTSTATUS Status;
+  REG_QUERY_KEY_INFORMATION QueryKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
 
-  DPRINT("NtQueryKey(KH %x  KIC %x  KI %x  L %d  RL %x)\n",
+  PAGED_CODE();
+
+  DPRINT("NtQueryKey(KH 0x%p  KIC %x  KI 0x%p  L %d  RL 0x%p)\n",
         KeyHandle,
         KeyInformationClass,
         KeyInformation,
@@ -914,9 +1422,9 @@ NtQueryKey(IN HANDLE KeyHandle,
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
-               KEY_READ,
+               (KeyInformationClass != KeyNameInformation ? KEY_QUERY_VALUE : 0),
                CmiKeyType,
-               UserMode,
+               ExGetPreviousMode(),
                (PVOID *) &KeyObject,
                NULL);
   if (!NT_SUCCESS(Status))
@@ -924,9 +1432,23 @@ NtQueryKey(IN HANDLE KeyHandle,
       return Status;
     }
 
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  QueryKeyInfo.Object = (PVOID)KeyObject;
+  QueryKeyInfo.KeyInformationClass = KeyInformationClass;
+  QueryKeyInfo.KeyInformation = KeyInformation;
+  QueryKeyInfo.Length = Length;
+  QueryKeyInfo.ResultLength = ResultLength;
+  
+  Status = CmiCallRegisteredCallbacks(RegNtQueryKey, &QueryKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject(KeyObject);
+      return Status;
+    }
+
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceSharedLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -938,13 +1460,14 @@ NtQueryKey(IN HANDLE KeyHandle,
   switch (KeyInformationClass)
     {
       case KeyBasicInformation:
-       /* Check size of buffer */
-       *ResultLength = sizeof(KEY_BASIC_INFORMATION) +
-         KeyObject->Name.Length;
+        NameSize = KeyObject->Name.Length;
 
-       if (Length < *ResultLength)
+       *ResultLength = FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]);
+
+       /* Check size of buffer */
+       if (Length < FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]))
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -955,20 +1478,31 @@ NtQueryKey(IN HANDLE KeyHandle,
            BasicInformation->TitleIndex = 0;
            BasicInformation->NameLength = KeyObject->Name.Length;
 
+           if (Length - FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]) <
+               NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_BASIC_INFORMATION, Name[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            RtlCopyMemory(BasicInformation->Name,
                          KeyObject->Name.Buffer,
-                         KeyObject->Name.Length);
+                         NameSize);
          }
        break;
 
       case KeyNodeInformation:
-       /* Check size of buffer */
-       *ResultLength = sizeof(KEY_NODE_INFORMATION) +
-         KeyObject->Name.Length + KeyCell->ClassSize;
+        NameSize = KeyObject->Name.Length;
+        ClassSize = KeyCell->ClassSize;
+
+       *ResultLength = FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) +
+         NameSize + ClassSize;
 
+       /* Check size of buffer */
        if (Length < *ResultLength)
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -982,30 +1516,48 @@ NtQueryKey(IN HANDLE KeyHandle,
            NodeInformation->ClassLength = KeyCell->ClassSize;
            NodeInformation->NameLength = KeyObject->Name.Length;
 
+           if (Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) < NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]);
+               ClassSize = 0;
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+           else if (Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) -
+                    NameSize < ClassSize)
+             {
+               ClassSize = Length - FIELD_OFFSET(KEY_NODE_INFORMATION, Name[0]) -
+                           NameSize;
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            RtlCopyMemory(NodeInformation->Name,
                          KeyObject->Name.Buffer,
-                         KeyObject->Name.Length);
+                         NameSize);
 
-           if (KeyCell->ClassSize != 0)
+           if (ClassSize != 0)
              {
                ClassCell = CmiGetCell (KeyObject->RegistryHive,
                                        KeyCell->ClassNameOffset,
                                        NULL);
                RtlCopyMemory (NodeInformation->Name + KeyObject->Name.Length,
                               ClassCell->Data,
-                              KeyCell->ClassSize);
+                              ClassSize);
              }
          }
        break;
 
       case KeyFullInformation:
-       /* Check size of buffer */
-       *ResultLength = sizeof(KEY_FULL_INFORMATION) +
-         KeyCell->ClassSize;
+        ClassSize = KeyCell->ClassSize;
 
-       if (Length < *ResultLength)
+       *ResultLength = FIELD_OFFSET(KEY_FULL_INFORMATION, Class) +
+         ClassSize;
+
+       /* Check size of buffer */
+       if (Length < FIELD_OFFSET(KEY_FULL_INFORMATION, Class))
          {
-           Status = STATUS_BUFFER_OVERFLOW;
+           Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
@@ -1024,26 +1576,44 @@ NtQueryKey(IN HANDLE KeyHandle,
              CmiGetMaxValueNameLength(RegistryHive, KeyCell);
            FullInformation->MaxValueDataLen =
              CmiGetMaxValueDataLength(RegistryHive, KeyCell);
-           if (KeyCell->ClassSize != 0)
+
+           if (Length - FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]) < ClassSize)
+             {
+               ClassSize = Length - FIELD_OFFSET(KEY_FULL_INFORMATION, Class[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
+           if (ClassSize)
              {
                ClassCell = CmiGetCell (KeyObject->RegistryHive,
                                        KeyCell->ClassNameOffset,
                                        NULL);
                RtlCopyMemory (FullInformation->Class,
-                              ClassCell->Data,
-                              KeyCell->ClassSize);
+                              ClassCell->Data, ClassSize);
              }
          }
        break;
 
+      case KeyNameInformation:
+      case KeyCachedInformation:
+      case KeyFlagsInformation:
+        DPRINT1("Key information class 0x%x not yet implemented!\n", KeyInformationClass);
+        Status = STATUS_NOT_IMPLEMENTED;
+        break;
+
       default:
        DPRINT1("Not handling 0x%x\n", KeyInformationClass);
        Status = STATUS_INVALID_INFO_CLASS;
        break;
     }
 
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
+
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostQueryKey, &PostOperationInfo);
+
   ObDereferenceObject(KeyObject);
 
   return(Status);
@@ -1059,7 +1629,7 @@ NtQueryValueKey(IN HANDLE KeyHandle,
        OUT PULONG ResultLength)
 {
   NTSTATUS  Status;
-  ULONG NameSize;
+  ULONG NameSize, DataSize;
   PKEY_OBJECT  KeyObject;
   PREGISTRY_HIVE  RegistryHive;
   PKEY_CELL  KeyCell;
@@ -1068,27 +1638,45 @@ NtQueryValueKey(IN HANDLE KeyHandle,
   PKEY_VALUE_BASIC_INFORMATION  ValueBasicInformation;
   PKEY_VALUE_PARTIAL_INFORMATION  ValuePartialInformation;
   PKEY_VALUE_FULL_INFORMATION  ValueFullInformation;
+  REG_QUERY_VALUE_KEY_INFORMATION QueryValueKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
 
-  DPRINT("NtQueryValueKey(KeyHandle %x  ValueName %S  Length %x)\n",
+  PAGED_CODE();
+
+  DPRINT("NtQueryValueKey(KeyHandle 0x%p  ValueName %S  Length %x)\n",
     KeyHandle, ValueName->Buffer, Length);
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
                KEY_QUERY_VALUE,
                CmiKeyType,
-               UserMode,
+               ExGetPreviousMode(),
                (PVOID *)&KeyObject,
                NULL);
 
   if (!NT_SUCCESS(Status))
     {
-      DPRINT1("ObReferenceObjectByHandle() failed with status %x\n", Status);
+      DPRINT1("ObReferenceObjectByHandle() failed with status %x %p\n", Status, KeyHandle);
+      return Status;
+    }
+  
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  QueryValueKeyInfo.Object = (PVOID)KeyObject;
+  QueryValueKeyInfo.ValueName = ValueName;
+  QueryValueKeyInfo.KeyValueInformationClass = KeyValueInformationClass;
+  QueryValueKeyInfo.Length = Length;
+  QueryValueKeyInfo.ResultLength = ResultLength;
+
+  Status = CmiCallRegisteredCallbacks(RegNtPreQueryValueKey, &QueryValueKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject(KeyObject);
       return Status;
     }
 
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceSharedLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -1117,37 +1705,52 @@ NtQueryValueKey(IN HANDLE KeyHandle,
          {
            NameSize *= sizeof(WCHAR);
          }
-       *ResultLength = sizeof(KEY_VALUE_BASIC_INFORMATION) + NameSize;
-       if (Length < *ResultLength)
+
+       *ResultLength = FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]) +
+                       NameSize;
+
+       if (Length < FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]))
          {
            Status = STATUS_BUFFER_TOO_SMALL;
          }
        else
          {
-           ValueBasicInformation = (PKEY_VALUE_BASIC_INFORMATION) 
+           ValueBasicInformation = (PKEY_VALUE_BASIC_INFORMATION)
              KeyValueInformation;
            ValueBasicInformation->TitleIndex = 0;
            ValueBasicInformation->Type = ValueCell->DataType;
            ValueBasicInformation->NameLength = NameSize;
+
+           if (Length - FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]) <
+               NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_VALUE_BASIC_INFORMATION, Name[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            if (ValueCell->Flags & REG_VALUE_NAME_PACKED)
              {
                CmiCopyPackedName(ValueBasicInformation->Name,
                                  ValueCell->Name,
-                                 ValueCell->NameSize);
+                                 NameSize / sizeof(WCHAR));
              }
            else
              {
                RtlCopyMemory(ValueBasicInformation->Name,
                              ValueCell->Name,
-                             ValueCell->NameSize * sizeof(WCHAR));
+                             NameSize);
              }
          }
        break;
 
       case KeyValuePartialInformation:
-       *ResultLength = sizeof(KEY_VALUE_PARTIAL_INFORMATION)
-         + (ValueCell->DataSize & REG_DATA_SIZE_MASK);
-       if (Length < *ResultLength)
+       DataSize = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+       *ResultLength = FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]) +
+                       DataSize;
+
+       if (Length < FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]))
          {
            Status = STATUS_BUFFER_TOO_SMALL;
          }
@@ -1157,19 +1760,28 @@ NtQueryValueKey(IN HANDLE KeyHandle,
              KeyValueInformation;
            ValuePartialInformation->TitleIndex = 0;
            ValuePartialInformation->Type = ValueCell->DataType;
-           ValuePartialInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+           ValuePartialInformation->DataLength = DataSize;
+
+           if (Length - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]) <
+               DataSize)
+             {
+               DataSize = Length - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data[0]);
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET))
              {
                DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
                RtlCopyMemory(ValuePartialInformation->Data,
                              DataCell->Data,
-                             ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                             DataSize);
              }
            else
              {
                RtlCopyMemory(ValuePartialInformation->Data,
                              &ValueCell->DataOffset,
-                             ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                             DataSize);
              }
          }
        break;
@@ -1180,9 +1792,12 @@ NtQueryValueKey(IN HANDLE KeyHandle,
          {
            NameSize *= sizeof(WCHAR);
          }
-       *ResultLength = sizeof(KEY_VALUE_FULL_INFORMATION) + 
-       NameSize + (ValueCell->DataSize & REG_DATA_SIZE_MASK);
-       if (Length < *ResultLength)
+       DataSize = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+       *ResultLength = ROUND_UP(FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
+                       Name[0]) + NameSize, sizeof(PVOID)) + DataSize;
+
+       if (Length < FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]))
          {
            Status = STATUS_BUFFER_TOO_SMALL;
          }
@@ -1193,38 +1808,57 @@ NtQueryValueKey(IN HANDLE KeyHandle,
            ValueFullInformation->TitleIndex = 0;
            ValueFullInformation->Type = ValueCell->DataType;
            ValueFullInformation->NameLength = NameSize;
+           ValueFullInformation->DataOffset =
+             (ULONG_PTR)ValueFullInformation->Name -
+             (ULONG_PTR)ValueFullInformation +
+             ValueFullInformation->NameLength;
+           ValueFullInformation->DataOffset =
+             ROUND_UP(ValueFullInformation->DataOffset, sizeof(PVOID));
+           ValueFullInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
+
+           if (Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]) <
+               NameSize)
+             {
+               NameSize = Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION, Name[0]);
+               DataSize = 0;
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+            else if (ROUND_UP(Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
+                     Name[0]) - NameSize, sizeof(PVOID)) < DataSize)
+             {
+               DataSize = ROUND_UP(Length - FIELD_OFFSET(KEY_VALUE_FULL_INFORMATION,
+                                   Name[0]) - NameSize, sizeof(PVOID));
+               Status = STATUS_BUFFER_OVERFLOW;
+               CHECKPOINT;
+             }
+
            if (ValueCell->Flags & REG_VALUE_NAME_PACKED)
              {
                CmiCopyPackedName(ValueFullInformation->Name,
                                  ValueCell->Name,
-                                 ValueCell->NameSize);
+                                 NameSize / sizeof(WCHAR));
              }
            else
              {
                RtlCopyMemory(ValueFullInformation->Name,
                              ValueCell->Name,
-                             ValueCell->NameSize);
+                             NameSize);
              }
-           ValueFullInformation->DataOffset = 
-             (ULONG)ValueFullInformation->Name - (ULONG)ValueFullInformation +
-             ValueFullInformation->NameLength;
-           ValueFullInformation->DataOffset =
-             ROUND_UP(ValueFullInformation->DataOffset, sizeof(PVOID));
-           ValueFullInformation->DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
            if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET))
              {
                DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
                RtlCopyMemory((PCHAR) ValueFullInformation
                              + ValueFullInformation->DataOffset,
                              DataCell->Data,
-                             ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                             DataSize);
              }
            else
              {
                RtlCopyMemory((PCHAR) ValueFullInformation
                              + ValueFullInformation->DataOffset,
                              &ValueCell->DataOffset,
-                             ValueCell->DataSize & REG_DATA_SIZE_MASK);
+                             DataSize);
              }
          }
        break;
@@ -1236,8 +1870,11 @@ NtQueryValueKey(IN HANDLE KeyHandle,
     }
 
 ByeBye:;
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
+
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostQueryValueKey, &PostOperationInfo);
   ObDereferenceObject(KeyObject);
 
   return Status;
@@ -1260,29 +1897,45 @@ NtSetValueKey(IN HANDLE KeyHandle,
   BLOCK_OFFSET ValueCellOffset;
   PDATA_CELL DataCell;
   PDATA_CELL NewDataCell;
-  PHBIN pBin;
   ULONG DesiredAccess;
+  REG_SET_VALUE_KEY_INFORMATION SetValueKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
+  ULONG DataCellSize;
 
-  DPRINT("NtSetValueKey(KeyHandle %x  ValueName '%wZ'  Type %d)\n",
+  PAGED_CODE();
+
+  DPRINT("NtSetValueKey(KeyHandle 0x%p  ValueName '%wZ'  Type %d)\n",
         KeyHandle, ValueName, Type);
 
   DesiredAccess = KEY_SET_VALUE;
-  if (Type == REG_LINK)
-    DesiredAccess |= KEY_CREATE_LINK;
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
                                     DesiredAccess,
                                     CmiKeyType,
-                                    UserMode,
+                                    ExGetPreviousMode(),
                                     (PVOID *)&KeyObject,
                                     NULL);
   if (!NT_SUCCESS(Status))
     return(Status);
 
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  SetValueKeyInfo.Object = (PVOID)KeyObject;
+  SetValueKeyInfo.ValueName = ValueName;
+  SetValueKeyInfo.TitleIndex = TitleIndex;
+  SetValueKeyInfo.Type = Type;
+  SetValueKeyInfo.Data = Data;
+  SetValueKeyInfo.DataSize = DataSize;
+  Status = CmiCallRegisteredCallbacks(RegNtPreSetValueKey, &SetValueKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject(KeyObject);
+      return Status;
+    }
+
   /* Acquire hive lock exclucively */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -1309,8 +1962,10 @@ NtSetValueKey(IN HANDLE KeyHandle,
     {
       DPRINT("Cannot add value. Status 0x%X\n", Status);
 
-      ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
+      PostOperationInfo.Status = Status;
+      CmiCallRegisteredCallbacks(RegNtPostSetValueKey, &PostOperationInfo);
       ObDereferenceObject(KeyObject);
       return Status;
     }
@@ -1319,72 +1974,74 @@ NtSetValueKey(IN HANDLE KeyHandle,
   DPRINT("ValueCell %p\n", ValueCell);
   DPRINT("ValueCell->DataSize %lu\n", ValueCell->DataSize);
 
+  if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET) &&
+      (ValueCell->DataSize & REG_DATA_SIZE_MASK) != 0)
+    {
+      DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
+      DataCellSize = (DataCell->CellSize < 0 ? -DataCell->CellSize : DataCell->CellSize) - sizeof(CELL_HEADER);
+    }
+  else
+    {
+      DataCell = NULL;
+      DataCellSize = 0;
+    }
+
+
   if (DataSize <= sizeof(BLOCK_OFFSET))
     {
       /* If data size <= sizeof(BLOCK_OFFSET) then store data in the data offset */
       DPRINT("ValueCell->DataSize %lu\n", ValueCell->DataSize);
-      if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET) &&
-         (ValueCell->DataSize & REG_DATA_SIZE_MASK) != 0)
+      if (DataCell)
        {
-         DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
          CmiDestroyCell(RegistryHive, DataCell, ValueCell->DataOffset);
        }
 
       RtlCopyMemory(&ValueCell->DataOffset, Data, DataSize);
       ValueCell->DataSize = DataSize | REG_DATA_IN_OFFSET;
       ValueCell->DataType = Type;
-      RtlMoveMemory(&ValueCell->DataOffset, Data, DataSize);
       CmiMarkBlockDirty(RegistryHive, ValueCellOffset);
     }
-  else if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET) &&
-          (DataSize <= (ValueCell->DataSize & REG_DATA_SIZE_MASK)))
+  else 
     {
-      /* If new data size is <= current then overwrite current data */
-      DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset,&pBin);
-      RtlZeroMemory(DataCell->Data, ValueCell->DataSize);
-      RtlCopyMemory(DataCell->Data, Data, DataSize);
-      ValueCell->DataSize = DataSize;
-      ValueCell->DataType = Type;
-    }
-  else
-    {
-      /*
-       * New data size is larger than the current, destroy current
-       * data block and allocate a new one.
-       */
-      BLOCK_OFFSET NewOffset;
-
-      DPRINT("ValueCell->DataSize %lu\n", ValueCell->DataSize);
+      if (DataSize > DataCellSize)
+        {
+         /*
+          * New data size is larger than the current, destroy current
+          * data block and allocate a new one.
+          */
+          BLOCK_OFFSET NewOffset;
+
+          DPRINT("ValueCell->DataSize %lu\n", ValueCell->DataSize);
+
+          Status = CmiAllocateCell (RegistryHive,
+                                   sizeof(CELL_HEADER) + DataSize,
+                                   (PVOID *)&NewDataCell,
+                                   &NewOffset);
+          if (!NT_SUCCESS(Status))
+           {
+             DPRINT("CmiAllocateBlock() failed (Status %lx)\n", Status);
 
-      if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET) &&
-         (ValueCell->DataSize & REG_DATA_SIZE_MASK) != 0)
-       {
-         DataCell = CmiGetCell (RegistryHive, ValueCell->DataOffset, NULL);
-         CmiDestroyCell(RegistryHive, DataCell, ValueCell->DataOffset);
-         ValueCell->DataSize = 0;
-         ValueCell->DataType = 0;
-         ValueCell->DataOffset = (BLOCK_OFFSET)-1;
-       }
+             ExReleaseResourceLite(&CmiRegistryLock);
+             KeLeaveCriticalRegion();
+              PostOperationInfo.Status = Status;
+              CmiCallRegisteredCallbacks(RegNtPostSetValueKey, &PostOperationInfo);
+             ObDereferenceObject(KeyObject);
 
-      Status = CmiAllocateCell (RegistryHive,
-                               sizeof(CELL_HEADER) + DataSize,
-                               (PVOID *)&NewDataCell,
-                               &NewOffset);
-      if (!NT_SUCCESS(Status))
-       {
-         DPRINT("CmiAllocateBlock() failed (Status %lx)\n", Status);
+             return Status;
+           }
 
-         ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
-         KeLeaveCriticalRegion();
-         ObDereferenceObject(KeyObject);
+          if (DataCell)
+           {
+             CmiDestroyCell(RegistryHive, DataCell, ValueCell->DataOffset);
+           }
 
-         return Status;
-       }
+          ValueCell->DataOffset = NewOffset;
+          DataCell = NewDataCell;
+        }
 
-      RtlCopyMemory(&NewDataCell->Data[0], Data, DataSize);
+      RtlCopyMemory(DataCell->Data, Data, DataSize);
       ValueCell->DataSize = DataSize & REG_DATA_SIZE_MASK;
       ValueCell->DataType = Type;
-      ValueCell->DataOffset = NewOffset;
       CmiMarkBlockDirty(RegistryHive, ValueCell->DataOffset);
       CmiMarkBlockDirty(RegistryHive, ValueCellOffset);
     }
@@ -1396,11 +2053,13 @@ NtSetValueKey(IN HANDLE KeyHandle,
       KeyCell->Flags |= REG_KEY_LINK_CELL;
     }
 
-  NtQuerySystemTime (&KeyCell->LastWriteTime);
+  KeQuerySystemTime (&KeyCell->LastWriteTime);
   CmiMarkBlockDirty (RegistryHive, KeyObject->KeyCellOffset);
 
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostSetValueKey, &PostOperationInfo);
   ObDereferenceObject(KeyObject);
 
   CmiSyncHives();
@@ -1417,12 +2076,20 @@ NtDeleteValueKey (IN HANDLE KeyHandle,
 {
   PKEY_OBJECT KeyObject;
   NTSTATUS Status;
+  REG_DELETE_VALUE_KEY_INFORMATION DeleteValueKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
+  KPROCESSOR_MODE PreviousMode;
+  UNICODE_STRING CapturedValueName;
+
+  PAGED_CODE();
+  
+  PreviousMode = ExGetPreviousMode();
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
-               KEY_QUERY_VALUE,
+               KEY_SET_VALUE,
                CmiKeyType,
-               UserMode,
+               PreviousMode,
                (PVOID *)&KeyObject,
                NULL);
   if (!NT_SUCCESS(Status))
@@ -1430,9 +2097,30 @@ NtDeleteValueKey (IN HANDLE KeyHandle,
       return Status;
     }
 
+  Status = ProbeAndCaptureUnicodeString(&CapturedValueName,
+                                        PreviousMode,
+                                        ValueName);
+  if (!NT_SUCCESS(Status))
+    {
+      goto Fail;
+    }
+  DeleteValueKeyInfo.Object = (PVOID)KeyObject;
+  DeleteValueKeyInfo.ValueName = &CapturedValueName;
+
+  /* FIXME - check if value exists before calling the callbacks? */
+  Status = CmiCallRegisteredCallbacks(RegNtPreDeleteValueKey, &DeleteValueKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ReleaseCapturedUnicodeString(&CapturedValueName,
+                                   PreviousMode);
+Fail:
+      ObDereferenceObject(KeyObject);
+      return Status;
+    }
+
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -1441,13 +2129,21 @@ NtDeleteValueKey (IN HANDLE KeyHandle,
                                 KeyObject->KeyCellOffset,
                                 ValueName);
 
-  NtQuerySystemTime (&KeyObject->KeyCell->LastWriteTime);
+  KeQuerySystemTime (&KeyObject->KeyCell->LastWriteTime);
   CmiMarkBlockDirty (KeyObject->RegistryHive, KeyObject->KeyCellOffset);
 
   /* Release hive lock */
-  ExReleaseResourceLite (&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
+  ReleaseCapturedUnicodeString(&CapturedValueName,
+                               PreviousMode);
+
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  PostOperationInfo.Status = Status;
+
+  CmiCallRegisteredCallbacks(RegNtPostDeleteValueKey, &PostOperationInfo);
+
   ObDereferenceObject (KeyObject);
 
   CmiSyncHives ();
@@ -1489,10 +2185,12 @@ NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes,
   ULONG Length;
   NTSTATUS Status;
 
+  PAGED_CODE();
+
   DPRINT ("NtLoadKey2() called\n");
 
 #if 0
-  if (!SeSinglePrivilegeCheck (SeRestorePrivilege, KeGetPreviousMode ()))
+  if (!SeSinglePrivilegeCheck (SeRestorePrivilege, ExGetPreviousMode ()))
     return STATUS_PRIVILEGE_NOT_HELD;
 #endif
 
@@ -1505,7 +2203,7 @@ NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes,
       if (Buffer == NULL)
        return STATUS_INSUFFICIENT_RESOURCES;
 
-      Status = NtQueryObject (FileObjectAttributes->RootDirectory,
+      Status = ZwQueryObject (FileObjectAttributes->RootDirectory,
                              ObjectNameInformation,
                              Buffer,
                              BufferSize,
@@ -1569,6 +2267,10 @@ NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes,
 
   DPRINT ("Full name: '%wZ'\n", NamePointer);
 
+  /* Acquire hive lock */
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
+
   Status = CmiLoadHive (KeyObjectAttributes,
                        NamePointer,
                        Flags);
@@ -1577,6 +2279,10 @@ NtLoadKey2 (IN POBJECT_ATTRIBUTES KeyObjectAttributes,
       DPRINT1 ("CmiLoadHive() failed (Status %lx)\n", Status);
     }
 
+  /* Release hive lock */
+  ExReleaseResourceLite(&CmiRegistryLock);
+  KeLeaveCriticalRegion();
+
   if (Buffer != NULL)
     ExFreePool (Buffer);
 
@@ -1591,15 +2297,43 @@ NtNotifyChangeKey (IN HANDLE KeyHandle,
                   IN PVOID ApcContext OPTIONAL,
                   OUT PIO_STATUS_BLOCK IoStatusBlock,
                   IN ULONG CompletionFilter,
-                  IN BOOLEAN Asynchroneous,
-                  OUT PVOID ChangeBuffer,
+                  IN BOOLEAN WatchSubtree,
+                  OUT PVOID Buffer,
                   IN ULONG Length,
-                  IN BOOLEAN WatchSubtree)
+                  IN BOOLEAN Asynchronous)
 {
        UNIMPLEMENTED;
        return(STATUS_NOT_IMPLEMENTED);
 }
 
+#if 0
+NTSTATUS STDCALL
+NtNotifyChangeKey (IN HANDLE KeyHandle,
+                  IN HANDLE Event,
+                  IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
+                  IN PVOID ApcContext OPTIONAL,
+                  OUT PIO_STATUS_BLOCK IoStatusBlock,
+                  IN ULONG CompletionFilter,
+                  IN BOOLEAN WatchSubtree,
+                  OUT PVOID Buffer,
+                  IN ULONG Length,
+                  IN BOOLEAN Asynchronous)
+{
+     return NtNotifyChangeMultipleKeys(KeyHandle,
+                                       0,
+                                       NULL,
+                                       Event,
+                                       ApcRoutine,
+                                       ApcContext,
+                                       IoStatusBlock,
+                                       CompletionFilter,
+                                       WatchTree,
+                                       Buffer,
+                                       Length,
+                                       Asynchronous);
+}
+
+#endif
 
 NTSTATUS STDCALL
 NtQueryMultipleValueKey (IN HANDLE KeyHandle,
@@ -1618,12 +2352,16 @@ NtQueryMultipleValueKey (IN HANDLE KeyHandle,
   NTSTATUS Status;
   PUCHAR DataPtr;
   ULONG i;
+  REG_QUERY_MULTIPLE_VALUE_KEY_INFORMATION QueryMultipleValueKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
+
+  PAGED_CODE();
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle(KeyHandle,
                                     KEY_QUERY_VALUE,
                                     CmiKeyType,
-                                    UserMode,
+                                    ExGetPreviousMode(),
                                     (PVOID *) &KeyObject,
                                     NULL);
   if (!NT_SUCCESS(Status))
@@ -1632,9 +2370,24 @@ NtQueryMultipleValueKey (IN HANDLE KeyHandle,
       return(Status);
     }
 
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  QueryMultipleValueKeyInfo.Object = (PVOID)KeyObject;
+  QueryMultipleValueKeyInfo.ValueEntries = ValueList;
+  QueryMultipleValueKeyInfo.EntryCount = NumberOfValues;
+  QueryMultipleValueKeyInfo.ValueBuffer = Buffer;
+  QueryMultipleValueKeyInfo.BufferLength = Length;
+  QueryMultipleValueKeyInfo.RequiredBufferLength = ReturnLength;
+
+  Status = CmiCallRegisteredCallbacks(RegNtPreQueryMultipleValueKey, &QueryMultipleValueKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject(KeyObject);
+      return Status;
+    }
+
   /* Acquire hive lock */
   KeEnterCriticalRegion();
-  ExAcquireResourceSharedLite(&KeyObject->RegistryHive->HiveResource, TRUE);
+  ExAcquireResourceSharedLite(&CmiRegistryLock, TRUE);
 
   VERIFY_KEY_OBJECT(KeyObject);
 
@@ -1670,11 +2423,11 @@ NtQueryMultipleValueKey (IN HANDLE KeyHandle,
 
       if (BufferLength + (ValueCell->DataSize & REG_DATA_SIZE_MASK) <= *Length)
        {
-         DataPtr = (PUCHAR)ROUND_UP((ULONG)DataPtr, sizeof(PVOID));
+         DataPtr = (PUCHAR)ROUND_UP((ULONG_PTR)DataPtr, sizeof(PVOID));
 
          ValueList[i].Type = ValueCell->DataType;
          ValueList[i].DataLength = ValueCell->DataSize & REG_DATA_SIZE_MASK;
-         ValueList[i].DataOffset = (ULONG) DataPtr - (ULONG) Buffer;
+         ValueList[i].DataOffset = (ULONG_PTR)DataPtr - (ULONG_PTR)Buffer;
 
          if (!(ValueCell->DataSize & REG_DATA_IN_OFFSET))
            {
@@ -1708,9 +2461,12 @@ NtQueryMultipleValueKey (IN HANDLE KeyHandle,
   *ReturnLength = BufferLength;
 
   /* Release hive lock */
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostQueryMultipleValueKey, &PostOperationInfo);
+
   ObDereferenceObject(KeyObject);
 
   DPRINT("Return Status 0x%X\n", Status);
@@ -1747,17 +2503,19 @@ NtSaveKey (IN HANDLE KeyHandle,
   PKEY_OBJECT KeyObject;
   NTSTATUS Status;
 
+  PAGED_CODE();
+
   DPRINT ("NtSaveKey() called\n");
 
 #if 0
-  if (!SeSinglePrivilegeCheck (SeBackupPrivilege, KeGetPreviousMode ()))
+  if (!SeSinglePrivilegeCheck (SeBackupPrivilege, ExGetPreviousMode ()))
     return STATUS_PRIVILEGE_NOT_HELD;
 #endif
 
   Status = ObReferenceObjectByHandle (KeyHandle,
                                      0,
                                      CmiKeyType,
-                                     KeGetPreviousMode(),
+                                     ExGetPreviousMode(),
                                      (PVOID *)&KeyObject,
                                      NULL);
   if (!NT_SUCCESS(Status))
@@ -1768,14 +2526,13 @@ NtSaveKey (IN HANDLE KeyHandle,
 
   /* Acquire hive lock exclucively */
   KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite (&KeyObject->RegistryHive->HiveResource,
-                                 TRUE);
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
   /* Refuse to save a volatile key */
   if (KeyObject->RegistryHive == CmiVolatileHive)
     {
       DPRINT1 ("Cannot save a volatile key\n");
-      ExReleaseResourceLite (&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
       ObDereferenceObject (KeyObject);
       return STATUS_ACCESS_DENIED;
@@ -1785,7 +2542,7 @@ NtSaveKey (IN HANDLE KeyHandle,
   if (!NT_SUCCESS(Status))
     {
       DPRINT1 ("CmiCreateTempHive() failed (Status %lx)\n", Status);
-      ExReleaseResourceLite (&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
       ObDereferenceObject (KeyObject);
       return(Status);
@@ -1799,7 +2556,7 @@ NtSaveKey (IN HANDLE KeyHandle,
     {
       DPRINT1 ("CmiCopyKey() failed (Status %lx)\n", Status);
       CmiRemoveRegistryHive (TempHive);
-      ExReleaseResourceLite (&KeyObject->RegistryHive->HiveResource);
+      ExReleaseResourceLite(&CmiRegistryLock);
       KeLeaveCriticalRegion();
       ObDereferenceObject (KeyObject);
       return(Status);
@@ -1815,7 +2572,7 @@ NtSaveKey (IN HANDLE KeyHandle,
   CmiRemoveRegistryHive (TempHive);
 
   /* Release hive lock */
-  ExReleaseResourceLite(&KeyObject->RegistryHive->HiveResource);
+  ExReleaseResourceLite(&CmiRegistryLock);
   KeLeaveCriticalRegion();
 
   ObDereferenceObject (KeyObject);
@@ -1825,6 +2582,21 @@ NtSaveKey (IN HANDLE KeyHandle,
   return STATUS_SUCCESS;
 }
 
+/*
+ * @unimplemented
+ */
+NTSTATUS
+STDCALL
+NtSaveKeyEx(
+       IN HANDLE KeyHandle,
+       IN HANDLE FileHandle,
+       IN ULONG Flags // REG_STANDARD_FORMAT, etc..
+       )
+{
+       UNIMPLEMENTED;
+       return STATUS_NOT_IMPLEMENTED;
+}
+
 
 NTSTATUS STDCALL
 NtSetInformationKey (IN HANDLE KeyHandle,
@@ -1834,18 +2606,16 @@ NtSetInformationKey (IN HANDLE KeyHandle,
 {
   PKEY_OBJECT KeyObject;
   NTSTATUS Status;
+  REG_SET_INFORMATION_KEY_INFORMATION SetInformationKeyInfo;
+  REG_POST_OPERATION_INFORMATION PostOperationInfo;
 
-  if (KeyInformationClass != KeyLastWriteTimeInformation)
-    return STATUS_INVALID_INFO_CLASS;
-
-  if (KeyInformationLength != sizeof (KEY_LAST_WRITE_TIME_INFORMATION))
-    return STATUS_INFO_LENGTH_MISMATCH;
+  PAGED_CODE();
 
   /* Verify that the handle is valid and is a registry key */
   Status = ObReferenceObjectByHandle (KeyHandle,
                                      KEY_SET_VALUE,
                                      CmiKeyType,
-                                     UserMode,
+                                     ExGetPreviousMode(),
                                      (PVOID *)&KeyObject,
                                      NULL);
   if (!NT_SUCCESS (Status))
@@ -1854,25 +2624,56 @@ NtSetInformationKey (IN HANDLE KeyHandle,
       return Status;
     }
 
-  /* Acquire hive lock */
-  KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite (&KeyObject->RegistryHive->HiveResource, TRUE);
+  PostOperationInfo.Object = (PVOID)KeyObject;
+  SetInformationKeyInfo.Object = (PVOID)KeyObject;
+  SetInformationKeyInfo.KeySetInformationClass = KeyInformationClass;
+  SetInformationKeyInfo.KeySetInformation = KeyInformation;
+  SetInformationKeyInfo.KeySetInformationLength = KeyInformationLength;
 
-  VERIFY_KEY_OBJECT(KeyObject);
+  Status = CmiCallRegisteredCallbacks(RegNtSetInformationKey, &SetInformationKeyInfo);
+  if (!NT_SUCCESS(Status))
+    {
+      ObDereferenceObject (KeyObject);
+      return Status;
+    }
+
+  if (KeyInformationClass != KeyWriteTimeInformation)
+    {
+      Status = STATUS_INVALID_INFO_CLASS;
+    }
+
+  else if (KeyInformationLength != sizeof (KEY_WRITE_TIME_INFORMATION))
+    {
+      Status = STATUS_INFO_LENGTH_MISMATCH;
+    }
+  else
+    {
+      /* Acquire hive lock */
+      KeEnterCriticalRegion();
+      ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
 
-  KeyObject->KeyCell->LastWriteTime.QuadPart =
-    ((PKEY_LAST_WRITE_TIME_INFORMATION)KeyInformation)->LastWriteTime.QuadPart;
+      VERIFY_KEY_OBJECT(KeyObject);
 
-  CmiMarkBlockDirty (KeyObject->RegistryHive,
-                    KeyObject->KeyCellOffset);
+      KeyObject->KeyCell->LastWriteTime.QuadPart =
+        ((PKEY_WRITE_TIME_INFORMATION)KeyInformation)->LastWriteTime.QuadPart;
 
-  /* Release hive lock */
-  ExReleaseResourceLite (&KeyObject->RegistryHive->HiveResource);
-  KeLeaveCriticalRegion();
+      CmiMarkBlockDirty (KeyObject->RegistryHive,
+                        KeyObject->KeyCellOffset);
+
+      /* Release hive lock */
+      ExReleaseResourceLite(&CmiRegistryLock);
+      KeLeaveCriticalRegion();
+    }
+
+  PostOperationInfo.Status = Status;
+  CmiCallRegisteredCallbacks(RegNtPostSetInformationKey, &PostOperationInfo);
 
   ObDereferenceObject (KeyObject);
 
-  CmiSyncHives ();
+  if (NT_SUCCESS(Status))
+    {
+      CmiSyncHives ();
+    }
 
   DPRINT ("NtSaveKey() done\n");
 
@@ -1891,40 +2692,43 @@ NtUnloadKey (IN POBJECT_ATTRIBUTES KeyObjectAttributes)
   PREGISTRY_HIVE RegistryHive;
   NTSTATUS Status;
 
+  PAGED_CODE();
+
   DPRINT ("NtUnloadKey() called\n");
 
 #if 0
-  if (!SeSinglePrivilegeCheck (SeRestorePrivilege, KeGetPreviousMode ()))
+  if (!SeSinglePrivilegeCheck (SeRestorePrivilege, ExGetPreviousMode ()))
     return STATUS_PRIVILEGE_NOT_HELD;
 #endif
 
+  /* Acquire registry lock exclusively */
+  KeEnterCriticalRegion();
+  ExAcquireResourceExclusiveLite(&CmiRegistryLock, TRUE);
+
   Status = CmiDisconnectHive (KeyObjectAttributes,
                              &RegistryHive);
   if (!NT_SUCCESS (Status))
     {
       DPRINT1 ("CmiDisconnectHive() failed (Status %lx)\n", Status);
+      ExReleaseResourceLite (&CmiRegistryLock);
+      KeLeaveCriticalRegion();
       return Status;
     }
 
   DPRINT ("RegistryHive %p\n", RegistryHive);
 
-  /* Acquire hive list lock exclusively */
-  KeEnterCriticalRegion();
-  ExAcquireResourceExclusiveLite (&CmiHiveListLock,
-                                 TRUE);
-
 #if 0
   /* Flush hive */
   if (!IsNoFileHive (RegistryHive))
     CmiFlushRegistryHive (RegistryHive);
 #endif
 
-  /* Release hive list lock */
-  ExReleaseResourceLite (&CmiHiveListLock);
-  KeLeaveCriticalRegion();
-
   CmiRemoveRegistryHive (RegistryHive);
 
+  /* Release registry lock */
+  ExReleaseResourceLite (&CmiRegistryLock);
+  KeLeaveCriticalRegion();
+
   DPRINT ("NtUnloadKey() done\n");
 
   return STATUS_SUCCESS;
@@ -1936,10 +2740,13 @@ NtInitializeRegistry (IN BOOLEAN SetUpBoot)
 {
   NTSTATUS Status;
 
+  PAGED_CODE();
+
   if (CmiRegistryInitialized == TRUE)
     return STATUS_ACCESS_DENIED;
 
-  /* FIXME: save boot log file */
+  /* Save boot log file */
+  IopSaveBootLogToFile();
 
   Status = CmiInitHives (SetUpBoot);