diff --git a/reactos/include/csrss/csrss.h b/reactos/include/csrss/csrss.h
index 0bb8d0cf5a0..3e3a1e279eb 100644
--- a/reactos/include/csrss/csrss.h
+++ b/reactos/include/csrss/csrss.h
@@ -11,6 +11,7 @@
 #define CSR_PRIORITY_CLASS_HIGH		(0x40)
 #define CSR_PRIORITY_CLASS_REALTIME	(0x80)
 
+#define CSR_CSRSS_SECTION_SIZE          (65536)
 
 typedef struct
 {
@@ -222,7 +223,7 @@ typedef struct
   COORD BufferSize;
   COORD BufferCoord;
   SMALL_RECT WriteRegion;
-  CHAR_INFO CharInfo[0];
+  CHAR_INFO* CharInfo;
 } CSRSS_WRITE_CONSOLE_OUTPUT_REQUEST, *PCSRSS_WRITE_CONSOLE_OUTPUT_REQUEST;
 
 typedef struct
diff --git a/reactos/include/ntdll/csr.h b/reactos/include/ntdll/csr.h
index 65d7e08cc89..f130713577a 100644
--- a/reactos/include/ntdll/csr.h
+++ b/reactos/include/ntdll/csr.h
@@ -1,4 +1,4 @@
-/* $Id: csr.h,v 1.6 2001/06/17 20:05:09 ea Exp $
+/* $Id: csr.h,v 1.7 2001/12/02 23:34:39 dwelch Exp $
  *
  */
 
@@ -25,6 +25,13 @@ VOID STDCALL CsrProbeForRead(IN CONST PVOID Address,
 VOID STDCALL CsrProbeForWrite(IN CONST PVOID Address,
 			      IN ULONG Length,
 			      IN ULONG Alignment);
+NTSTATUS STDCALL
+CsrCaptureParameterBuffer(PVOID ParameterBuffer,
+			  ULONG ParameterBufferSize,
+			  PVOID* ClientAddress,
+			  PVOID* ServerAddress);
+NTSTATUS STDCALL
+CsrReleaseParameterBuffer(PVOID ClientAddress);
 
 #endif /* __INCLUDE_NTDLL_CSR_H */
 
diff --git a/reactos/include/ntos/heap.h b/reactos/include/ntos/heap.h
index 7e6b685d029..5efac191de1 100644
--- a/reactos/include/ntos/heap.h
+++ b/reactos/include/ntos/heap.h
@@ -19,6 +19,6 @@
 #define HEAP_ZERO_MEMORY	(8)
 #define HEAP_REALLOC_IN_PLACE_ONLY	(16)
 #define HEAP_GROWABLE (32)
-
+#define HEAP_NO_VALLOC (64)
 
 #endif /* __INCLUDE_HEAP_H */
diff --git a/reactos/lib/kernel32/misc/console.c b/reactos/lib/kernel32/misc/console.c
index e4103e58e54..eee14aa0699 100644
--- a/reactos/lib/kernel32/misc/console.c
+++ b/reactos/lib/kernel32/misc/console.c
@@ -1,4 +1,4 @@
-/* $Id: console.c,v 1.37 2001/11/25 15:21:09 dwelch Exp $
+/* $Id: console.c,v 1.38 2001/12/02 23:34:40 dwelch Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS system libraries
@@ -1153,52 +1153,23 @@ WriteConsoleOutputA(HANDLE		 hConsoleOutput,
   ULONG Size;
   BOOLEAN Result;
   ULONG i, j;
+  PVOID BufferBase;
+  PVOID BufferTargetBase;
 
   Size = dwBufferSize.Y * dwBufferSize.X * sizeof(CHAR_INFO);
 
-  if ((sizeof(CSRSS_API_REQUEST) + Size) > 
-      (sizeof(LPC_MESSAGE) + MAX_MESSAGE_DATA))
+  Status = CsrCaptureParameterBuffer((PVOID)lpBuffer,
+				     Size,
+				     &BufferBase,
+				     &BufferTargetBase);
+  if (!NT_SUCCESS(Status))
     {
-      COORD FragDim, FragCoord;
-      SMALL_RECT FragRegion;
-      DWORD SizeX, SizeY;
-      CONST CHAR_INFO* lpFragBuffer;
-
-      SizeX = min(dwBufferSize.X - dwBufferCoord.X, 
-		  lpWriteRegion->Right - lpWriteRegion->Left);
-      SizeY = min(dwBufferSize.Y - dwBufferCoord.Y, 
-		  lpWriteRegion->Bottom - lpWriteRegion->Top);
-
-      for (i = dwBufferCoord.Y; i < (dwBufferCoord.Y + SizeY); i++)
-	{
-	  for (j = dwBufferCoord.X; j < (dwBufferCoord.X + SizeX); j++)
-	    {
-	      FragDim.X = 1;
-	      FragDim.Y = 1;
-	      FragCoord.X = 0;
-	      FragCoord.Y = 0;
-	      FragRegion.Left = lpWriteRegion->Left + j;
-	      FragRegion.Right = lpWriteRegion->Left + j + 1;
-	      FragRegion.Top = lpWriteRegion->Top + i;
-	      FragRegion.Bottom = lpWriteRegion->Bottom + i + 1;
-
-	      lpFragBuffer = lpBuffer + (i * dwBufferSize.X) + j;
-	      Result = WriteConsoleOutputA(hConsoleOutput,
-					   lpFragBuffer,
-					   FragDim,
-					   FragCoord,
-					   &FragRegion);
-	      if (!Result)
-		{
-		  return(FALSE);
-		}	      
-	    }
-	}
-      return(TRUE);
+      SetLastErrorByStatus(Status);
+      return(FALSE);
     }
   
   Request = RtlAllocateHeap(GetProcessHeap(), HEAP_ZERO_MEMORY, 
-			    sizeof(CSRSS_API_REQUEST) + Size);
+			    sizeof(CSRSS_API_REQUEST));
   if (Request == NULL)
     {
       SetLastError(ERROR_OUTOFMEMORY);
@@ -1209,11 +1180,11 @@ WriteConsoleOutputA(HANDLE		 hConsoleOutput,
   Request->Data.WriteConsoleOutputRequest.BufferSize = dwBufferSize;
   Request->Data.WriteConsoleOutputRequest.BufferCoord = dwBufferCoord;
   Request->Data.WriteConsoleOutputRequest.WriteRegion = *lpWriteRegion;
-  RtlCopyMemory(&Request->Data.WriteConsoleOutputRequest.CharInfo, lpBuffer, 
-		Size);
+  Request->Data.WriteConsoleOutputRequest.CharInfo = 
+    (CHAR_INFO*)BufferTargetBase;
   
   Status = CsrClientCallServer(Request, &Reply, 
-			       sizeof(CSRSS_API_REQUEST) + Size, 
+			       sizeof(CSRSS_API_REQUEST), 
 			       sizeof(CSRSS_API_REPLY));
   if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Reply.Status))
     {
@@ -1224,6 +1195,7 @@ WriteConsoleOutputA(HANDLE		 hConsoleOutput,
       
   *lpWriteRegion = Reply.Data.WriteConsoleOutputReply.WriteRegion;
   RtlFreeHeap(GetProcessHeap(), 0, Request);
+  CsrReleaseParameterBuffer(BufferBase);
   return(TRUE);
 }
 
diff --git a/reactos/lib/ntdll/csr/lpc.c b/reactos/lib/ntdll/csr/lpc.c
index dcfe2de8146..8bcbfcfe1f7 100644
--- a/reactos/lib/ntdll/csr/lpc.c
+++ b/reactos/lib/ntdll/csr/lpc.c
@@ -1,4 +1,4 @@
-/* $Id: lpc.c,v 1.3 2001/11/25 15:21:09 dwelch Exp $
+/* $Id: lpc.c,v 1.4 2001/12/02 23:34:40 dwelch Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -25,6 +25,11 @@
 /* GLOBALS *******************************************************************/
 
 HANDLE WindowsApiPort = INVALID_HANDLE_VALUE;
+static PVOID CsrSectionMapBase = NULL;
+static PVOID CsrSectionMapServerBase = NULL;
+static HANDLE CsrCommHeap = NULL;
+
+#define CSR_CONTROL_HEAP_SIZE (65536)
 
 /* FUNCTIONS *****************************************************************/
 
@@ -51,6 +56,33 @@ Request is the family of PCSRSS_XXX_REQUEST objects.
 XXX_REQUEST depend on the CsrApiNumber.Index.
 
 */
+
+NTSTATUS STDCALL
+CsrCaptureParameterBuffer(PVOID ParameterBuffer,
+			  ULONG ParameterBufferSize,
+			  PVOID* ClientAddress,
+			  PVOID* ServerAddress)
+{
+  PVOID Block;
+
+  Block = RtlAllocateHeap(CsrCommHeap, 0, ParameterBufferSize);
+  if (Block == NULL)
+    {
+      return(STATUS_NO_MEMORY);
+    }
+  memcpy(Block, ParameterBuffer, ParameterBufferSize);
+  *ClientAddress = Block;
+  *ServerAddress = Block - CsrSectionMapBase + CsrSectionMapServerBase;
+  return(STATUS_SUCCESS);
+}
+
+NTSTATUS STDCALL
+CsrReleaseParameterBuffer(PVOID ClientAddress)
+{
+  RtlFreeHeap(CsrCommHeap, 0, ClientAddress);
+  return(STATUS_SUCCESS);
+}
+
 NTSTATUS STDCALL
 CsrClientCallServer(PCSRSS_API_REQUEST Request,
 		    PCSRSS_API_REPLY Reply OPTIONAL,
@@ -83,13 +115,32 @@ CsrClientConnectToServer(VOID)
    ULONG ConnectInfoLength;
    CSRSS_API_REQUEST Request;
    CSRSS_API_REPLY Reply;
-   
+   LPC_SECTION_WRITE LpcWrite;
+   HANDLE CsrSectionHandle;
+   ULONG CsrSectionViewSize;
+
+   CsrSectionViewSize = CSR_CSRSS_SECTION_SIZE;
+   Status = NtCreateSection(&CsrSectionHandle,
+			    SECTION_ALL_ACCESS,
+			    NULL,
+			    &CsrSectionViewSize,
+			    PAGE_READWRITE,
+			    SEC_COMMIT,
+			    NULL);
+   if (!NT_SUCCESS(Status))
+     {
+       return(Status);
+     }
    RtlInitUnicodeString(&PortName, L"\\Windows\\ApiPort");
    ConnectInfoLength = 0;
+   LpcWrite.Length = sizeof(LPC_SECTION_WRITE);
+   LpcWrite.SectionHandle = CsrSectionHandle;
+   LpcWrite.SectionOffset = 0;
+   LpcWrite.ViewSize = CsrSectionViewSize;
    Status = NtConnectPort(&WindowsApiPort,
 			  &PortName,
 			  NULL,
-			  NULL,
+			  &LpcWrite,
 			  NULL,
 			  NULL,
 			  NULL,
@@ -98,6 +149,22 @@ CsrClientConnectToServer(VOID)
      {
 	return(Status);
      }
+
+   NtClose(CsrSectionHandle);
+   CsrSectionMapBase = LpcWrite.ViewBase;
+   CsrSectionMapServerBase = LpcWrite.TargetViewBase;
+
+   /* Create the heap for communication for csrss. */
+   CsrCommHeap = RtlCreateHeap(HEAP_NO_VALLOC,
+			       CsrSectionMapBase,
+			       CsrSectionViewSize,
+			       CsrSectionViewSize,
+			       0,
+			       NULL);
+   if (CsrCommHeap == NULL)
+     {
+       return(STATUS_NO_MEMORY);
+     }
    
    Request.Type = CSRSS_CONNECT_PROCESS;
    Status = CsrClientCallServer(&Request,
diff --git a/reactos/lib/ntdll/def/ntdll.def b/reactos/lib/ntdll/def/ntdll.def
index 6660aabdeed..e9c3e0648c7 100644
--- a/reactos/lib/ntdll/def/ntdll.def
+++ b/reactos/lib/ntdll/def/ntdll.def
@@ -1,10 +1,12 @@
-; $Id: ntdll.def,v 1.81 2001/11/21 22:31:18 ekohl Exp $
+; $Id: ntdll.def,v 1.82 2001/12/02 23:34:41 dwelch Exp $
 ;
 ; ReactOS Operating System
 ;
 LIBRARY ntdll.dll
 
 EXPORTS
+CsrCaptureParameterBuffer@16
+CsrReleaseParameterBuffer@4
 CsrAllocateCaptureBuffer@12
 CsrAllocateCapturePointer@12
 CsrAllocateMessagePointer@12
diff --git a/reactos/lib/ntdll/def/ntdll.edf b/reactos/lib/ntdll/def/ntdll.edf
index 9e7cc479c6e..ba1e7c70882 100644
--- a/reactos/lib/ntdll/def/ntdll.edf
+++ b/reactos/lib/ntdll/def/ntdll.edf
@@ -1,10 +1,12 @@
-; $Id: ntdll.edf,v 1.70 2001/11/21 22:31:18 ekohl Exp $
+; $Id: ntdll.edf,v 1.71 2001/12/02 23:34:41 dwelch Exp $
 ;
 ; ReactOS Operating System
 ;
 LIBRARY ntdll.dll
 
 EXPORTS
+CsrCaptureParameterBuffer=CsrCaptureParameterBuffer@16
+CsrReleaseParameterBuffer=CsrReleaseParameterBuffer@4
 CsrAllocateCaptureBuffer=CsrAllocateCaptureBuffer@12
 CsrAllocateCapturePointer=CsrAllocateCapturePointer@12
 CsrAllocateMessagePointer=CsrAllocateMessagePointer@12
diff --git a/reactos/lib/ntdll/rtl/heap.c b/reactos/lib/ntdll/rtl/heap.c
index 4405be28371..97e3b456d75 100644
--- a/reactos/lib/ntdll/rtl/heap.c
+++ b/reactos/lib/ntdll/rtl/heap.c
@@ -282,7 +282,8 @@ HEAP_FindSubHeap(HEAP *heap,  /* [in] Heap pointer */
  */
 static inline BOOL
 HEAP_Commit(SUBHEAP *subheap,
-	    void *ptr)
+	    void *ptr,
+	    DWORD flags)
 {
     DWORD size = (DWORD)((char *)ptr - (char *)subheap);
     NTSTATUS Status;
@@ -296,20 +297,23 @@ HEAP_Commit(SUBHEAP *subheap,
     address = (PVOID)((char *)subheap + subheap->commitSize);
     commitsize = size - subheap->commitSize;
 
-    Status = NtAllocateVirtualMemory(NtCurrentProcess(),
-				     &address,
-				     0,
-				     &commitsize,
-				     MEM_COMMIT,
-				     PAGE_EXECUTE_READWRITE);
-    if (!NT_SUCCESS(Status))
-    {
-        WARN("Could not commit %08lx bytes at %08lx for heap %08lx\n",
+    if (!(flags & HEAP_NO_VALLOC))
+      {
+	Status = NtAllocateVirtualMemory(NtCurrentProcess(),
+					 &address,
+					 0,
+					 &commitsize,
+					 MEM_COMMIT,
+					 PAGE_EXECUTE_READWRITE);
+	if (!NT_SUCCESS(Status))
+	  {
+	    WARN("Could not commit %08lx bytes at %08lx for heap %08lx\n",
                  size - subheap->commitSize,
                  (DWORD)((char *)subheap + subheap->commitSize),
                  (DWORD)subheap->heap );
-        return FALSE;
-    }
+	    return FALSE;
+	  }
+      }
     subheap->commitSize = size;
     return TRUE;
 }
@@ -320,7 +324,7 @@ HEAP_Commit(SUBHEAP *subheap,
  *
  * If possible, decommit the heap storage from (including) 'ptr'.
  */
-static inline BOOL HEAP_Decommit( SUBHEAP *subheap, void *ptr )
+static inline BOOL HEAP_Decommit( SUBHEAP *subheap, void *ptr, DWORD flags )
 {
     DWORD size = (DWORD)((char *)ptr - (char *)subheap);
     PVOID address;
@@ -333,18 +337,21 @@ static inline BOOL HEAP_Decommit( SUBHEAP *subheap, void *ptr )
     address = (PVOID)((char *)subheap + size);
     decommitsize = subheap->commitSize - size;
 
-    Status = ZwFreeVirtualMemory(NtCurrentProcess(),
-				 &address,
-				 &decommitsize,
-				 MEM_DECOMMIT);
-    if (!NT_SUCCESS(Status));
-    {
-        WARN("Could not decommit %08lx bytes at %08lx for heap %08lx\n",
-                 subheap->commitSize - size,
-                 (DWORD)((char *)subheap + size),
-                 (DWORD)subheap->heap );
-        return FALSE;
-    }
+    if (!(flags & HEAP_NO_VALLOC))
+      {
+	Status = ZwFreeVirtualMemory(NtCurrentProcess(),
+				     &address,
+				     &decommitsize,
+				     MEM_DECOMMIT);
+	if (!NT_SUCCESS(Status));
+	{
+	  WARN("Could not decommit %08lx bytes at %08lx for heap %08lx\n",
+	       subheap->commitSize - size,
+	       (DWORD)((char *)subheap + size),
+	       (DWORD)subheap->heap );
+	  return FALSE;
+	}
+      }
     subheap->commitSize = size;
     return TRUE;
 }
@@ -413,7 +420,8 @@ static void HEAP_CreateFreeBlock( SUBHEAP *subheap, void *ptr, DWORD size )
  * Turn an in-use block into a free block. Can also decommit the end of
  * the heap, and possibly even free the sub-heap altogether.
  */
-static void HEAP_MakeInUseBlockFree( SUBHEAP *subheap, ARENA_INUSE *pArena )
+static void HEAP_MakeInUseBlockFree( SUBHEAP *subheap, ARENA_INUSE *pArena,
+				     DWORD flags)
 {
     ARENA_FREE *pFree;
     DWORD size = (pArena->size & ARENA_SIZE_MASK) + sizeof(*pArena);
@@ -451,10 +459,13 @@ static void HEAP_MakeInUseBlockFree( SUBHEAP *subheap, ARENA_INUSE *pArena )
         if (pPrev) pPrev->next = subheap->next;
         /* Free the memory */
         subheap->magic = 0;
-        ZwFreeVirtualMemory(NtCurrentProcess(),
-			    (PVOID*)&subheap,
-			    0,
-			    MEM_RELEASE);
+	if (!(flags & HEAP_NO_VALLOC))
+	  {
+	    ZwFreeVirtualMemory(NtCurrentProcess(),
+				(PVOID*)&subheap,
+				0,
+				MEM_RELEASE);
+	  }
         return;
     }
     
@@ -497,19 +508,21 @@ static BOOL HEAP_InitSubHeap( HEAP *heap, LPVOID address, DWORD flags,
     NTSTATUS Status;
    
     /* Commit memory */
-
-    Status = ZwAllocateVirtualMemory(NtCurrentProcess(),
-				     &address,
-				     0,
-				     (PULONG)&commitSize,
-				     MEM_COMMIT,
-				     PAGE_EXECUTE_READWRITE);
-   if (!NT_SUCCESS(Status))
-    {
-        WARN("Could not commit %08lx bytes for sub-heap %08lx\n",
-                   commitSize, (DWORD)address );
-        return FALSE;
-    }
+    if (!(flags & HEAP_NO_VALLOC))
+      {
+	Status = ZwAllocateVirtualMemory(NtCurrentProcess(),
+					 &address,
+					 0,
+					 (PULONG)&commitSize,
+					 MEM_COMMIT,
+					 PAGE_EXECUTE_READWRITE);
+	if (!NT_SUCCESS(Status))
+	  {
+	    WARN("Could not commit %08lx bytes for sub-heap %08lx\n",
+		 commitSize, (DWORD)address );
+	    return FALSE;
+	  }
+      }
 
     /* Fill the sub-heap structure */
 
@@ -584,32 +597,37 @@ static SUBHEAP *HEAP_CreateSubHeap(PVOID BaseAddress,
     if (!commitSize) commitSize = 0x10000;
     if (totalSize < commitSize) totalSize = commitSize;
 
-    /* Allocate the memory block */
-
+    /* Allocate the memory block */    
     address = BaseAddress;
-    Status = ZwAllocateVirtualMemory(NtCurrentProcess(),
-				     &address,
-				     0,
-				     (PULONG)&totalSize,
-				     MEM_RESERVE | MEM_COMMIT,
-				     PAGE_EXECUTE_READWRITE);
-    if (!NT_SUCCESS(Status))
-    {
-        WARN("Could not VirtualAlloc %08lx bytes\n",
+    if (!(flags & HEAP_NO_VALLOC))
+      {
+	Status = ZwAllocateVirtualMemory(NtCurrentProcess(),
+					 &address,
+					 0,
+					 (PULONG)&totalSize,
+					 MEM_RESERVE | MEM_COMMIT,
+					 PAGE_EXECUTE_READWRITE);
+	if (!NT_SUCCESS(Status))
+	  {
+	    WARN("Could not VirtualAlloc %08lx bytes\n",
                  totalSize );
-        return NULL;
-    }
+	    return NULL;
+	  }
+      }
 
     /* Initialize subheap */
 
     if (!HEAP_InitSubHeap( heap? heap : (HEAP *)address, 
                            address, flags, commitSize, totalSize ))
     {
-        ZwFreeVirtualMemory(NtCurrentProcess(),
-			    address,
-			    0,
-			    MEM_RELEASE);
-        return NULL;
+      if (!(flags & HEAP_NO_VALLOC))
+	{
+	  ZwFreeVirtualMemory(NtCurrentProcess(),
+			      address,
+			      0,
+			      MEM_RELEASE);
+	  return NULL;
+	}
     }
 
     return (SUBHEAP *)address;
@@ -639,7 +657,8 @@ static ARENA_FREE *HEAP_FindFreeBlock( HEAP *heap, DWORD size,
         {
             subheap = HEAP_FindSubHeap( heap, pArena );
             if (!HEAP_Commit( subheap, (char *)pArena + sizeof(ARENA_INUSE)
-                                               + size + HEAP_MIN_BLOCK_SIZE))
+                                               + size + HEAP_MIN_BLOCK_SIZE,
+			      heap->flags))
                 return NULL;
             *ppSubHeap = subheap;
             return pArena;
@@ -1043,11 +1062,13 @@ RtlDestroyHeap(HANDLE heap) /* [in] Handle of heap */
     {
         SUBHEAP *next = subheap->next;
 
-        ZwFreeVirtualMemory(NtCurrentProcess(),
-			    (PVOID*)&subheap,
-			    0,
-			    MEM_RELEASE);
-
+	if (!(heapPtr->flags & HEAP_NO_VALLOC))
+	  {
+	    ZwFreeVirtualMemory(NtCurrentProcess(),
+				(PVOID*)&subheap,
+				0,
+				MEM_RELEASE);
+	  }
         subheap = next;
     }
     return TRUE;
@@ -1160,7 +1181,7 @@ BOOLEAN STDCALL RtlFreeHeap(
 
     pInUse  = (ARENA_INUSE *)ptr - 1;
     subheap = HEAP_FindSubHeap( heapPtr, pInUse );
-    HEAP_MakeInUseBlockFree( subheap, pInUse );
+    HEAP_MakeInUseBlockFree( subheap, pInUse, heapPtr->flags );
 
     if (!(flags & HEAP_NO_SERIALIZE)) RtlLeaveCriticalSection( &heapPtr->critSection );
 
@@ -1227,7 +1248,8 @@ LPVOID STDCALL RtlReAllocateHeap(
             pFree->prev->next = pFree->next;
             pArena->size += (pFree->size & ARENA_SIZE_MASK) + sizeof(*pFree);
             if (!HEAP_Commit( subheap, (char *)pArena + sizeof(ARENA_INUSE)
-                                               + size + HEAP_MIN_BLOCK_SIZE))
+                                               + size + HEAP_MIN_BLOCK_SIZE,
+			      heapPtr->flags))
             {
                 if (!(flags & HEAP_NO_SERIALIZE)) RtlLeaveCriticalSection( &heapPtr->critSection );
                 return NULL;
@@ -1261,7 +1283,7 @@ LPVOID STDCALL RtlReAllocateHeap(
 
             /* Free the previous block */
 
-            HEAP_MakeInUseBlockFree( subheap, pArena );
+            HEAP_MakeInUseBlockFree( subheap, pArena, flags );
             subheap = newsubheap;
             pArena  = pInUse;
         }
diff --git a/reactos/ntoskrnl/include/internal/debug.h b/reactos/ntoskrnl/include/internal/debug.h
index 8ab9d1de2bf..5bc341b8dca 100644
--- a/reactos/ntoskrnl/include/internal/debug.h
+++ b/reactos/ntoskrnl/include/internal/debug.h
@@ -20,7 +20,6 @@
 
 #include <internal/ntoskrnl.h>
 #include <roscfg.h>
-#include <internal/dbg.h>
 
 #define UNIMPLEMENTED do {DbgPrint("%s at %s:%d is unimplemented, have a nice day\n",__FUNCTION__,__FILE__,__LINE__); for(;;);  } while(0);
 
diff --git a/reactos/ntoskrnl/include/internal/port.h b/reactos/ntoskrnl/include/internal/port.h
index b47eb13d187..0b811d1e5fb 100644
--- a/reactos/ntoskrnl/include/internal/port.h
+++ b/reactos/ntoskrnl/include/internal/port.h
@@ -30,6 +30,28 @@ typedef struct _EPORT_TERMINATION_REQUEST
 } EPORT_TERMINATION_REQUEST, *PEPORT_TERMINATION_REQUEST;
 
 
+typedef struct _EPORT_CONNECT_REQUEST_MESSAGE
+{
+  LPC_MESSAGE_HEADER MessageHeader;
+  PEPROCESS ConnectingProcess;
+  struct _SECTION_OBJECT* SendSectionObject;
+  LARGE_INTEGER SendSectionOffset;
+  ULONG SendViewSize;
+  ULONG ConnectDataLength;
+  UCHAR ConnectData[0];
+} EPORT_CONNECT_REQUEST_MESSAGE, *PEPORT_CONNECT_REQUEST_MESSAGE;
+
+typedef struct _EPORT_CONNECT_REPLY_MESSAGE
+{
+  LPC_MESSAGE_HEADER MessageHeader;
+  PVOID SendServerViewBase;
+  ULONG ReceiveClientViewSize;
+  PVOID ReceiveClientViewBase;
+  ULONG MaximumMessageSize;
+  ULONG ConnectDataLength;
+  UCHAR ConnectData[0];
+} EPORT_CONNECT_REPLY_MESSAGE, *PEPORT_CONNECT_REPLY_MESSAGE;
+
 NTSTATUS STDCALL
 LpcRequestPort (PEPORT		Port,
 		PLPC_MESSAGE	LpcMessage);
@@ -52,88 +74,62 @@ LpcSendTerminationPort (PEPORT	Port,
 
 typedef struct _QUEUEDMESSAGE
 {
-	PEPORT		Sender;
-	LIST_ENTRY	QueueListEntry;
-	LPC_MESSAGE	Message;
-	UCHAR		MessageData [MAX_MESSAGE_DATA];
+  PEPORT		Sender;
+  LIST_ENTRY	QueueListEntry;
+  LPC_MESSAGE	Message;
+  UCHAR		MessageData [MAX_MESSAGE_DATA];
 } QUEUEDMESSAGE,  *PQUEUEDMESSAGE;
 
 /* Code in ntoskrnl/lpc/close.h */
 
 VOID STDCALL
-NiClosePort (
-	PVOID	ObjectBody,
-	ULONG	HandleCount
-	);
+NiClosePort (PVOID	ObjectBody,
+	     ULONG	HandleCount);
 VOID STDCALL
-NiDeletePort (
-	IN	PVOID	ObjectBody
-	);
-
+NiDeletePort (IN	PVOID	ObjectBody);
 
 /* Code in ntoskrnl/lpc/queue.c */
 
-VOID
-STDCALL
-EiEnqueueConnectMessagePort (
-	IN OUT	PEPORT		Port,
-	IN	PQUEUEDMESSAGE	Message
-	);
-VOID
-STDCALL
-EiEnqueueMessagePort (
-	IN OUT	PEPORT		Port,
-	IN	PQUEUEDMESSAGE	Message
-	);
+VOID STDCALL
+EiEnqueueConnectMessagePort (IN OUT	PEPORT		Port,
+			     IN	PQUEUEDMESSAGE	Message);
+VOID STDCALL
+EiEnqueueMessagePort (IN OUT	PEPORT		Port,
+		      IN	PQUEUEDMESSAGE	Message);
 VOID STDCALL
 EiEnqueueMessageAtHeadPort (IN OUT	PEPORT		Port,
 			    IN	PQUEUEDMESSAGE	Message);
 PQUEUEDMESSAGE
 STDCALL
-EiDequeueConnectMessagePort (
-	IN OUT	PEPORT	Port
-	);
-PQUEUEDMESSAGE
-STDCALL
-EiDequeueMessagePort (
-	IN OUT	PEPORT	Port
-	);
+EiDequeueConnectMessagePort (IN OUT	PEPORT	Port);
+PQUEUEDMESSAGE STDCALL
+EiDequeueMessagePort (IN OUT	PEPORT	Port);
 
 /* Code in ntoskrnl/lpc/create.c */
 
 NTSTATUS STDCALL
-NiCreatePort (
-	PVOID			ObjectBody,
-	PVOID			Parent,
-	PWSTR			RemainingPath,
-	POBJECT_ATTRIBUTES	ObjectAttributes
-	);
+NiCreatePort (PVOID			ObjectBody,
+	      PVOID			Parent,
+	      PWSTR			RemainingPath,
+	      POBJECT_ATTRIBUTES	ObjectAttributes);
 
 /* Code in ntoskrnl/lpc/port.c */
 
+NTSTATUS STDCALL
+NiInitializePort (IN OUT	PEPORT	Port);
 NTSTATUS
-STDCALL
-NiInitializePort (
-	IN OUT	PEPORT	Port
-	);
-NTSTATUS
-NiInitPort (
-	VOID
-	);
+NiInitPort (VOID);
 
 extern POBJECT_TYPE	ExPortType;
 extern ULONG		EiNextLpcMessageId;
 
 /* Code in ntoskrnl/lpc/reply.c */
 
-NTSTATUS
-STDCALL
-EiReplyOrRequestPort (
-	IN	PEPORT		Port, 
-	IN	PLPC_MESSAGE	LpcReply, 
-	IN	ULONG		MessageType,
-	IN	PEPORT		Sender
-	);
+NTSTATUS STDCALL
+EiReplyOrRequestPort (IN	PEPORT		Port, 
+		      IN	PLPC_MESSAGE	LpcReply, 
+		      IN	ULONG		MessageType,
+		      IN	PEPORT		Sender);
 
 
 #endif /* __INCLUDE_INTERNAL_PORT_H */
diff --git a/reactos/ntoskrnl/ldr/loader.c b/reactos/ntoskrnl/ldr/loader.c
index c9edc2ed3a1..9cc2767a151 100644
--- a/reactos/ntoskrnl/ldr/loader.c
+++ b/reactos/ntoskrnl/ldr/loader.c
@@ -1,4 +1,4 @@
-/* $Id: loader.c,v 1.90 2001/09/16 13:19:32 chorns Exp $
+/* $Id: loader.c,v 1.91 2001/12/02 23:34:41 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -932,7 +932,7 @@ VOID LdrLoadAutoConfigDrivers (VOID)
    /*
     * Networking
     */
-#if 1
+#if 0
    /*
     * NDIS library
     */
diff --git a/reactos/ntoskrnl/lpc/close.c b/reactos/ntoskrnl/lpc/close.c
index 0a69bacaf89..272c69631af 100644
--- a/reactos/ntoskrnl/lpc/close.c
+++ b/reactos/ntoskrnl/lpc/close.c
@@ -1,4 +1,4 @@
-/* $Id: close.c,v 1.6 2001/08/26 17:28:00 ekohl Exp $
+/* $Id: close.c,v 1.7 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 /**********************************************************************
  * NAME
diff --git a/reactos/ntoskrnl/lpc/complete.c b/reactos/ntoskrnl/lpc/complete.c
index dc2d62b35aa..7796a66448b 100644
--- a/reactos/ntoskrnl/lpc/complete.c
+++ b/reactos/ntoskrnl/lpc/complete.c
@@ -1,4 +1,4 @@
-/* $Id: complete.c,v 1.4 2001/06/23 19:13:33 phreak Exp $
+/* $Id: complete.c,v 1.5 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -9,7 +9,7 @@
  *                  Created 22/05/98
  */
 
-/* INCLUDES *****************************************************************/
+/* INCLUDES ******************************************************************/
 
 #include <ddk/ntddk.h>
 #include <internal/ob.h>
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 /***********************************************************************
  * NAME							EXPORTED
@@ -47,7 +48,8 @@ NtCompleteConnectPort (HANDLE PortHandle)
   
   OurPort->State = EPORT_CONNECTED_SERVER;
   
-  KeReleaseSemaphore( &OurPort->OtherPort->Semaphore, IO_NO_INCREMENT, 1, FALSE );
+  KeReleaseSemaphore(&OurPort->OtherPort->Semaphore, IO_NO_INCREMENT, 1, 
+		     FALSE);
    
   ObDereferenceObject (OurPort);
   
diff --git a/reactos/ntoskrnl/lpc/connect.c b/reactos/ntoskrnl/lpc/connect.c
index b67b26185ed..59d0756a44d 100644
--- a/reactos/ntoskrnl/lpc/connect.c
+++ b/reactos/ntoskrnl/lpc/connect.c
@@ -1,4 +1,4 @@
-/* $Id: connect.c,v 1.7 2001/06/23 19:13:33 phreak Exp $
+/* $Id: connect.c,v 1.8 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -16,6 +16,8 @@
 #include <internal/port.h>
 #include <internal/dbg.h>
 #include <internal/pool.h>
+#include <internal/mm.h>
+#include <internal/safe.h>
 
 #define NDEBUG
 #include <internal/debug.h>
@@ -26,6 +28,190 @@
 
 /* FUNCTIONS *****************************************************************/
 
+NTSTATUS STDCALL
+EiConnectPort(IN PEPORT* ConnectedPort,
+	      IN PEPORT NamedPort,
+	      IN PSECTION_OBJECT Section,
+	      IN LARGE_INTEGER SectionOffset,
+	      IN ULONG ViewSize,
+	      OUT PVOID* ClientSendViewBase,
+	      OUT PVOID* ServerSendViewBase,
+	      OUT PULONG ReceiveViewSize,
+	      OUT PVOID* ReceiveViewBase,
+	      OUT PULONG MaximumMessageSize,
+	      IN OUT PVOID ConnectData,
+	      IN OUT PULONG ConnectDataLength)
+{
+  PEPORT_CONNECT_REQUEST_MESSAGE RequestMessage;
+  ULONG RequestConnectDataLength;
+  PEPORT OurPort;
+  PQUEUEDMESSAGE Reply;
+  PEPORT_CONNECT_REPLY_MESSAGE CReply;
+  NTSTATUS Status;
+  KIRQL oldIrql;
+
+  if (ConnectDataLength == NULL)
+    {
+      RequestConnectDataLength = 0;
+    }
+  else
+    {
+      RequestConnectDataLength = *ConnectDataLength;
+    }
+
+  /*
+   * Create a port to represent our side of the connection
+   */
+  Status = ObCreateObject (NULL,
+			   PORT_ALL_ACCESS,
+			   NULL,
+			   ExPortType,
+			   (PVOID*)&OurPort);
+  if (!NT_SUCCESS(Status))
+    {
+      return (Status);
+    }
+  NiInitializePort(OurPort);
+
+  /*
+   * Allocate a request message.
+   */
+  RequestMessage = ExAllocatePool(NonPagedPool, 
+				  sizeof(EPORT_CONNECT_REQUEST_MESSAGE) + 
+				  RequestConnectDataLength);
+  if (RequestMessage == NULL)
+    {
+      ObDereferenceObject(OurPort);
+      return(STATUS_NO_MEMORY);
+    }
+
+  /*
+   * Initialize the request message.
+   */
+  RequestMessage->MessageHeader.DataSize = 
+    sizeof(EPORT_CONNECT_REQUEST_MESSAGE) + RequestConnectDataLength -
+    sizeof(LPC_MESSAGE_HEADER);
+  RequestMessage->MessageHeader.MessageSize = 
+    sizeof(EPORT_CONNECT_REQUEST_MESSAGE) + RequestConnectDataLength;
+  DPRINT("RequestMessageSize %d\n",
+	 RequestMessage->MessageHeader.MessageSize);
+  RequestMessage->MessageHeader.SharedSectionSize = 0;
+  RequestMessage->ConnectingProcess = PsGetCurrentProcess();
+  ObReferenceObjectByPointer(RequestMessage->ConnectingProcess,
+			     PROCESS_VM_OPERATION,
+			     NULL,
+			     KernelMode);
+  RequestMessage->SendSectionObject = (struct _SECTION_OBJECT*)Section;
+  RequestMessage->SendSectionOffset = SectionOffset;
+  RequestMessage->SendViewSize = ViewSize;
+  RequestMessage->ConnectDataLength = RequestConnectDataLength;
+  if (RequestConnectDataLength > 0)
+    {
+      memcpy(RequestMessage->ConnectData, ConnectData,
+	     RequestConnectDataLength);
+    }
+  
+  /*
+   * Queue the message to the named port
+   */
+  EiReplyOrRequestPort(NamedPort,
+		       &RequestMessage->MessageHeader,
+		       LPC_CONNECTION_REQUEST,
+		       OurPort);
+  KeReleaseSemaphore(&NamedPort->Semaphore, IO_NO_INCREMENT, 1, FALSE);
+  ExFreePool(RequestMessage);
+  
+  /*
+   * Wait for them to accept our connection
+   */
+  KeWaitForSingleObject(&OurPort->Semaphore,
+			UserRequest,
+			UserMode,
+			FALSE,
+			NULL);
+
+  /* 
+   * Dequeue the response
+   */
+  KeAcquireSpinLock (&OurPort->Lock, &oldIrql);
+  Reply = EiDequeueMessagePort (OurPort);
+  KeReleaseSpinLock (&OurPort->Lock, oldIrql);
+  CReply = (PEPORT_CONNECT_REPLY_MESSAGE)&Reply->Message;
+
+  /*
+   * Do some initial cleanup.
+   */
+  ObDereferenceObject(PsGetCurrentProcess());
+
+  /*
+   * Check for connection refusal.
+   */
+  if (CReply->MessageHeader.MessageType == LPC_CONNECTION_REFUSED)
+    {
+      ObDereferenceObject(OurPort);
+      ExFreePool(Reply);
+      /*
+       * FIXME: Check what NT does here. Giving the user data back on
+       * connect failure sounds reasonable; it probably wouldn't break
+       * anything anyway.
+       */
+      if (ConnectDataLength != NULL)
+	{
+	  *ConnectDataLength = CReply->ConnectDataLength;
+	  memcpy(ConnectData, CReply->ConnectData, CReply->ConnectDataLength);
+	}
+      return(STATUS_PORT_CONNECTION_REFUSED);
+    }
+
+  /*
+   * Otherwise we are connected. Copy data back to the client.
+   */
+  *ServerSendViewBase = CReply->SendServerViewBase;
+  *ReceiveViewSize = CReply->ReceiveClientViewSize;
+  *ReceiveViewBase = CReply->ReceiveClientViewBase;
+  *MaximumMessageSize = CReply->MaximumMessageSize;
+  if (ConnectDataLength != NULL)
+    {
+      *ConnectDataLength = CReply->ConnectDataLength;
+      memcpy(ConnectData, CReply->ConnectData, CReply->ConnectDataLength);
+    }
+
+  /*
+   * Create our view of the send section object.
+   */
+  if (Section != NULL)
+    {
+      *ClientSendViewBase = 0;
+      Status = MmMapViewOfSection(Section,
+				  PsGetCurrentProcess(),
+				  ClientSendViewBase,
+				  0,
+				  ViewSize,
+				  &SectionOffset,
+				  &ViewSize,
+				  ViewUnmap,
+				  0 /* MEM_TOP_DOWN? */,
+				  PAGE_READWRITE);
+      if (!NT_SUCCESS(Status))
+	{
+	  /* FIXME: Cleanup here. */
+	  return(Status);
+	}
+    }
+
+  /*
+   * Do the final initialization of our port.
+   */
+  OurPort->State = EPORT_CONNECTED_CLIENT;
+
+  /*
+   * Cleanup.
+   */
+  ExFreePool(Reply);
+  *ConnectedPort = OurPort;
+  return(STATUS_SUCCESS);
+}
+
 /**********************************************************************
  * NAME							EXPORTED
  * 	NtConnectPort@32
@@ -48,126 +234,254 @@
  * 
  */
 NTSTATUS STDCALL
-NtConnectPort (PHANDLE				ConnectedPort,
+NtConnectPort (PHANDLE				UnsafeConnectedPortHandle,
 	       PUNICODE_STRING			PortName,
 	       PSECURITY_QUALITY_OF_SERVICE	Qos,
-	       PLPC_SECTION_WRITE		WriteMap,
-	       PLPC_SECTION_READ		ReadMap,
-	       PULONG				MaxMessageSize,
-	       PVOID				ConnectInfo,
-	       PULONG				UserConnectInfoLength)
+	       PLPC_SECTION_WRITE		UnsafeWriteMap,
+	       PLPC_SECTION_READ		UnsafeReadMap,
+	       PULONG				UnsafeMaximumMessageSize,
+	       PVOID				UnsafeConnectData,
+	       PULONG				UnsafeConnectDataLength)
 {
-  NTSTATUS	Status;
-  PEPORT		NamedPort;
-  PEPORT		OurPort;
-  HANDLE		OurPortHandle;
-  PLPC_MESSAGE	Request;
-  PQUEUEDMESSAGE	Reply;
-  ULONG		ConnectInfoLength;
-  KIRQL		oldIrql;
-   
-  DPRINT("PortName %x\n", PortName);
-  DPRINT("NtConnectPort(PortName %S)\n", PortName->Buffer);
+  HANDLE ConnectedPortHandle;
+  LPC_SECTION_WRITE WriteMap;
+  LPC_SECTION_READ ReadMap;
+  ULONG MaximumMessageSize;
+  PVOID ConnectData;
+  ULONG ConnectDataLength;
+  PSECTION_OBJECT SectionObject;
+  LARGE_INTEGER SectionOffset;
+  PEPORT ConnectedPort;
+  NTSTATUS Status;
+  PEPORT NamedPort;
   
   /*
-   * Copy in user parameters
+   * Copy in write map and partially validate.
    */
-  memcpy (&ConnectInfoLength, UserConnectInfoLength, 
-	  sizeof (*UserConnectInfoLength));
+  if (UnsafeWriteMap != NULL)
+    {
+      Status = MmCopyFromCaller(&WriteMap, UnsafeWriteMap, 
+				sizeof(LPC_SECTION_WRITE));
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+      if (WriteMap.Length != sizeof(LPC_SECTION_WRITE))
+	{
+	  return(STATUS_INVALID_PARAMETER_4);
+	}
+      SectionOffset.QuadPart = WriteMap.SectionOffset;
+    }
+  else
+    {
+      WriteMap.SectionHandle = INVALID_HANDLE_VALUE;
+    }
 
   /*
-   * Get access to the port
+   * Handle connection data.
+   */
+  if (UnsafeConnectData == NULL)
+    {
+      ConnectDataLength = 0;
+      ConnectData = NULL;
+    }
+  else
+    {
+      if (ExGetPreviousMode() == KernelMode)
+	{
+	  ConnectDataLength = *UnsafeConnectDataLength;
+	  ConnectData = UnsafeConnectData;
+	}
+      else
+	{
+	  Status = MmCopyFromCaller(&ConnectDataLength,
+				    UnsafeConnectDataLength,
+				    sizeof(ULONG));
+	  if (!NT_SUCCESS(Status))
+	    {
+	      return(Status);
+	    }
+	  ConnectData = ExAllocatePool(NonPagedPool, ConnectDataLength);
+	  if (ConnectData == NULL && ConnectDataLength != 0)
+	    {
+	      return(STATUS_NO_MEMORY);
+	    }
+	  Status = MmCopyFromCaller(ConnectData,
+				    UnsafeConnectData,
+				    ConnectDataLength);	
+	  if (!NT_SUCCESS(Status))
+	    {
+	      ExFreePool(ConnectData);
+	      return(Status);
+	    }
+	}
+    }
+
+  /*
+   * Reference the named port.
    */
   Status = ObReferenceObjectByName (PortName,
-				    0,
-				    NULL,
-				    PORT_ALL_ACCESS,  /* DesiredAccess */
-				    ExPortType,
-				    UserMode,
-				    NULL,
-				    (PVOID*)&NamedPort);
+                                    0,
+                                    NULL,
+                                    PORT_ALL_ACCESS,  /* DesiredAccess */
+                                    ExPortType,
+                                    UserMode,
+                                    NULL,
+                                    (PVOID*)&NamedPort);
   if (!NT_SUCCESS(Status))
     {
-      DPRINT("Failed to reference named port (status %x)\n", Status);
-      return (Status);
+      if (KeGetPreviousMode() != KernelMode)
+	{
+	  ExFreePool(ConnectData);
+	}
+      return(Status);
     }
-  /*
-   * Create a port to represent our side of the connection
-   */
-  Status = ObCreateObject (&OurPortHandle,
-			   PORT_ALL_ACCESS,
-			   NULL,
-			   ExPortType,
-			   (PVOID*)&OurPort);
-  if (!NT_SUCCESS(Status))
-    {
-      DPRINT("Failed to create port object (status %x)\n", Status);
-      return (Status);
-    }
-  NiInitializePort(OurPort);
-  /*
-   * Create a request message
-   */
-  DPRINT("Creating request message\n");
-  
-  Request = ExAllocatePoolWithTag (NonPagedPool,
-				   (sizeof (LPC_MESSAGE) + ConnectInfoLength),
-				   TAG_LPC_CONNECT_MESSAGE);
-   
-  Request->DataSize = ConnectInfoLength;
-  Request->MessageSize = sizeof(LPC_MESSAGE) + ConnectInfoLength;
-  Request->SharedSectionSize = 0;
-  if ((ConnectInfo != NULL) && (ConnectInfoLength > 0))
-    {
-      memcpy ((PVOID) (Request + 1), ConnectInfo, ConnectInfoLength);
-    }
-  /*
-   * Queue the message to the named port
-   */
-  DPRINT("Queuing message\n");
-  
-  EiReplyOrRequestPort (NamedPort,
-			Request,
-			LPC_CONNECTION_REQUEST,
-			OurPort);
-  KeReleaseSemaphore( &NamedPort->Semaphore, IO_NO_INCREMENT, 1, FALSE );
-   
-  DPRINT("Waiting for connection completion\n");
-  
-  /*
-   * Wait for them to accept our connection
-   */
-  KeWaitForSingleObject (&OurPort->Semaphore,
-			 UserRequest,
-			 UserMode,
-			 FALSE,
-			 NULL);
 
-  DPRINT("Received connection completion\n");
-  KeAcquireSpinLock (&OurPort->Lock, &oldIrql);
-  Reply = EiDequeueMessagePort (OurPort);
-  KeReleaseSpinLock (&OurPort->Lock, oldIrql);
-  memcpy (ConnectInfo, Reply->MessageData, Reply->Message.DataSize); 
-  *UserConnectInfoLength = Reply->Message.DataSize;
-  
-  if (Reply->Message.MessageType == LPC_CONNECTION_REFUSED)
+  /*
+   * Reference the send section object.
+   */
+  if (WriteMap.SectionHandle != INVALID_HANDLE_VALUE)
     {
-      ObDereferenceObject (NamedPort);
-      ObDereferenceObject (OurPort);
-      ZwClose (OurPortHandle);
-      ExFreePool (Request);
-      ExFreePool (Reply);
-      return (STATUS_UNSUCCESSFUL);
+      Status = ObReferenceObjectByHandle(WriteMap.SectionHandle,
+					 SECTION_MAP_READ | SECTION_MAP_WRITE,
+					 MmSectionObjectType,
+					 UserMode,
+					 (PVOID*)&SectionObject,
+					 NULL);
+      if (!NT_SUCCESS(Status))
+	{
+	  ObDereferenceObject(NamedPort);
+	  if (KeGetPreviousMode() != KernelMode)
+	    {
+	      ExFreePool(ConnectData);
+	    }
+	  return(Status);
+	}
     }
+  else
+    {
+      SectionObject = NULL;
+    }
+
+  /*
+   * Do the connection establishment.
+   */
+  Status = EiConnectPort(&ConnectedPort,
+			 NamedPort,
+			 SectionObject,
+			 SectionOffset,
+			 WriteMap.ViewSize,
+			 &WriteMap.ViewBase,
+			 &WriteMap.TargetViewBase,
+			 &ReadMap.ViewSize,
+			 &ReadMap.ViewBase,
+			 &MaximumMessageSize,
+			 ConnectData,
+			 &ConnectDataLength);
+  if (!NT_SUCCESS(Status))
+    {
+      /* FIXME: Again, check what NT does here. */
+      if (UnsafeConnectDataLength != NULL)
+	{
+	  if (ExGetPreviousMode() != KernelMode)
+	    {
+	      MmCopyToCaller(UnsafeConnectData, ConnectData,
+			     ConnectDataLength);
+	      ExFreePool(ConnectData);
+	    }
+	  MmCopyToCaller(UnsafeConnectDataLength, &ConnectDataLength,
+			 sizeof(ULONG));
+	}
+      return(Status);
+    }
+
+  /*
+   * Do some initial cleanup.
+   */
+  if (SectionObject != NULL)
+    {
+      ObDereferenceObject(SectionObject);
+      SectionObject = NULL;
+    }
+  ObDereferenceObject(NamedPort);
+  NamedPort = NULL;
   
-  OurPort->State = EPORT_CONNECTED_CLIENT;
-  *ConnectedPort = OurPortHandle;   
-  ExFreePool (Reply);
-  ExFreePool (Request);
-  
-  DPRINT("Exited successfully\n");
-  
-  return (STATUS_SUCCESS);
+  /*
+   * Copy the data back to the caller.
+   */
+  if (ExGetPreviousMode() != KernelMode)
+    {
+      if (UnsafeConnectDataLength != NULL)
+	{
+	  if (ExGetPreviousMode() != KernelMode)
+	    {
+	      Status = MmCopyToCaller(UnsafeConnectData, ConnectData,
+				      ConnectDataLength);
+	      ExFreePool(ConnectData);
+	      if (!NT_SUCCESS(Status))
+		{
+		  return(Status);
+		}
+	    }
+	  Status = MmCopyToCaller(UnsafeConnectDataLength, &ConnectDataLength,
+				  sizeof(ULONG));
+	  if (!NT_SUCCESS(Status))
+	    {
+	      return(Status);
+	    }
+	}
+    }
+  Status = ObInsertObject(ConnectedPort,
+			  NULL,
+			  PORT_ALL_ACCESS,
+			  0,
+			  NULL,
+			  &ConnectedPortHandle);
+  if (!NT_SUCCESS(Status))
+    {
+      return(Status);
+    }
+  Status = MmCopyToCaller(UnsafeConnectedPortHandle, &ConnectedPortHandle,
+			  sizeof(HANDLE));
+  if (!NT_SUCCESS(Status))
+    {
+      return(Status);
+    }
+  if (UnsafeWriteMap != NULL)
+    {
+      Status = MmCopyToCaller(UnsafeWriteMap, &WriteMap, 
+			      sizeof(LPC_SECTION_WRITE));
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+    }
+  if (UnsafeReadMap != NULL)
+    {
+      Status = MmCopyToCaller(UnsafeReadMap, &ReadMap,
+			      sizeof(LPC_SECTION_READ));
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+    }
+  if (UnsafeMaximumMessageSize != NULL)
+    {
+      Status = MmCopyToCaller(UnsafeMaximumMessageSize, 
+			      &MaximumMessageSize,
+			      sizeof(LPC_SECTION_WRITE));
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+    }
+
+  /*
+   * All done.
+   */
+  ObDereferenceObject(ConnectedPort);
+
+  return(STATUS_SUCCESS);
 }
 
 
@@ -201,17 +515,28 @@ NtAcceptConnectPort (PHANDLE			ServerPortHandle,
   PEPORT		OurPort = NULL;
   PQUEUEDMESSAGE	ConnectionRequest;
   KIRQL		oldIrql;
+  PEPORT_CONNECT_REQUEST_MESSAGE CRequest;
+  PEPORT_CONNECT_REPLY_MESSAGE CReply;
+
+  CReply = ExAllocatePool(NonPagedPool, 
+		 sizeof(EPORT_CONNECT_REPLY_MESSAGE) + LpcMessage->DataSize);
+  if (CReply == NULL)
+    {
+      return(STATUS_NO_MEMORY);
+    }
   
-  Status = ObReferenceObjectByHandle (NamedPortHandle,
-				      PORT_ALL_ACCESS,
-				      ExPortType,
-				      UserMode,
-				      (PVOID*)&NamedPort,
-				      NULL);
+  Status = ObReferenceObjectByHandle(NamedPortHandle,
+				     PORT_ALL_ACCESS,
+				     ExPortType,
+				     UserMode,
+				     (PVOID*)&NamedPort,
+				     NULL);
   if (!NT_SUCCESS(Status))
     {
+      ExFreePool(CReply);
       return (Status);
     }
+
   /*
    * Create a port object for our side of the connection
    */
@@ -229,41 +554,162 @@ NtAcceptConnectPort (PHANDLE			ServerPortHandle,
 	}
       NiInitializePort(OurPort);
     }
+  
   /*
    * Dequeue the connection request
    */
-  KeAcquireSpinLock (&NamedPort->Lock, & oldIrql);
+  KeAcquireSpinLock(&NamedPort->Lock, &oldIrql);
   ConnectionRequest = EiDequeueConnectMessagePort (NamedPort);
-  KeReleaseSpinLock (&NamedPort->Lock, oldIrql);
+  KeReleaseSpinLock(&NamedPort->Lock, oldIrql);
+  CRequest = (PEPORT_CONNECT_REQUEST_MESSAGE)(&ConnectionRequest->Message);
   
+  /*
+   * Prepare the reply.
+   */
+  if (LpcMessage != NULL)
+    {
+      memcpy(&CReply->MessageHeader, LpcMessage, sizeof(LPC_MESSAGE_HEADER));
+      memcpy(&CReply->ConnectData, (PVOID)(LpcMessage + 1), 
+	     LpcMessage->DataSize);
+      CReply->MessageHeader.MessageSize =
+	sizeof(EPORT_CONNECT_REPLY_MESSAGE) + LpcMessage->DataSize;
+      CReply->MessageHeader.DataSize = CReply->MessageHeader.MessageSize -
+	sizeof(LPC_MESSAGE_HEADER);
+      CReply->ConnectDataLength = LpcMessage->DataSize;
+    }
+  else
+    {
+      CReply->MessageHeader.MessageSize = sizeof(EPORT_CONNECT_REPLY_MESSAGE);
+      CReply->MessageHeader.DataSize = sizeof(EPORT_CONNECT_REPLY_MESSAGE) -
+	sizeof(LPC_MESSAGE_HEADER);
+      CReply->ConnectDataLength = 0;
+    }
+
   if (AcceptIt != 1)
     {	
-      EiReplyOrRequestPort (ConnectionRequest->Sender,
-			    LpcMessage,
-			    LPC_CONNECTION_REFUSED,
-			    NamedPort);
-      KeReleaseSemaphore( &ConnectionRequest->Sender->Semaphore,
-			  IO_NO_INCREMENT,
-			  1,
-			  FALSE);
-      ObDereferenceObject (ConnectionRequest->Sender);
-      ExFreePool (ConnectionRequest);	
-      ObDereferenceObject (NamedPort);
+      EiReplyOrRequestPort(ConnectionRequest->Sender,
+			   &CReply->MessageHeader,
+			   LPC_CONNECTION_REFUSED,
+			   NamedPort);
+      KeReleaseSemaphore(&ConnectionRequest->Sender->Semaphore,
+			 IO_NO_INCREMENT,
+			 1,
+			 FALSE);
+      ObDereferenceObject(ConnectionRequest->Sender);
+      ExFreePool(ConnectionRequest);	
+      ExFreePool(CReply);
+      ObDereferenceObject(NamedPort);
       return (STATUS_SUCCESS);
     }
+  
+  /*
+   * Prepare the connection.
+   */
+  if (WriteMap != NULL)
+    {
+      PSECTION_OBJECT SectionObject;
+      LARGE_INTEGER SectionOffset;
+
+      Status = ObReferenceObjectByHandle(WriteMap->SectionHandle,
+					 SECTION_MAP_READ | SECTION_MAP_WRITE,
+					 MmSectionObjectType,
+					 UserMode,
+					 (PVOID*)&SectionObject,
+					 NULL);
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+
+      SectionOffset.QuadPart = WriteMap->SectionOffset;
+      WriteMap->TargetViewBase = 0;
+      CReply->ReceiveClientViewSize = WriteMap->ViewSize;
+      Status = MmMapViewOfSection(SectionObject,
+				  CRequest->ConnectingProcess,
+				  &WriteMap->TargetViewBase,
+				  0,
+				  CReply->ReceiveClientViewSize,
+				  &SectionOffset,
+				  &CReply->ReceiveClientViewSize,
+				  ViewUnmap,
+				  0 /* MEM_TOP_DOWN? */,
+				  PAGE_READWRITE);
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}      
+
+      WriteMap->ViewBase = 0;
+      Status = MmMapViewOfSection(SectionObject,
+				  PsGetCurrentProcess(),
+				  &WriteMap->ViewBase,
+				  0,
+				  WriteMap->ViewSize,
+				  &SectionOffset,
+				  &WriteMap->ViewSize,
+				  ViewUnmap,
+				  0 /* MEM_TOP_DOWN? */,
+				  PAGE_READWRITE);
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}      
+      
+      ObDereferenceObject(SectionObject);
+    }
+  if (ReadMap != NULL && CRequest->SendSectionObject != NULL)
+    {
+      LARGE_INTEGER SectionOffset;
+
+      SectionOffset = CRequest->SendSectionOffset;
+      ReadMap->ViewSize = CRequest->SendViewSize;
+      ReadMap->ViewBase = 0;
+      Status = MmMapViewOfSection(CRequest->SendSectionObject,
+				  PsGetCurrentProcess(),
+				  &ReadMap->ViewBase,
+				  0,
+				  CRequest->SendViewSize,
+				  &SectionOffset,
+				  &CRequest->SendViewSize,
+				  ViewUnmap,
+				  0 /* MEM_TOP_DOWN? */,
+				  PAGE_READWRITE);
+      if (!NT_SUCCESS(Status))
+	{
+	  return(Status);
+	}
+    }
+
+  /*
+   * Finish the reply.
+   */
+  if (ReadMap != NULL)
+    {
+      CReply->SendServerViewBase = ReadMap->ViewBase;
+    }
+  else
+    {
+      CReply->SendServerViewBase = 0;
+    }
+  if (WriteMap != NULL)
+    {
+      CReply->ReceiveClientViewBase = WriteMap->TargetViewBase;
+    }
+  CReply->MaximumMessageSize = 0x148;
+
   /*
    * Connect the two ports
    */
   OurPort->OtherPort = ConnectionRequest->Sender;
   OurPort->OtherPort->OtherPort = OurPort;
-  EiReplyOrRequestPort (ConnectionRequest->Sender,
-			LpcMessage,
-			LPC_REPLY,
-			OurPort);
-  ExFreePool (ConnectionRequest);
+  EiReplyOrRequestPort(ConnectionRequest->Sender,
+		       LpcMessage,
+		       LPC_REPLY,
+		       OurPort);
+  ExFreePool(ConnectionRequest);
    
-  ObDereferenceObject (OurPort);
-  ObDereferenceObject (NamedPort);
+  ObDereferenceObject(OurPort);
+  ObDereferenceObject(NamedPort);
   
   return (STATUS_SUCCESS);
 }
diff --git a/reactos/ntoskrnl/lpc/create.c b/reactos/ntoskrnl/lpc/create.c
index 3cb242e3141..3ae5adfc004 100644
--- a/reactos/ntoskrnl/lpc/create.c
+++ b/reactos/ntoskrnl/lpc/create.c
@@ -1,4 +1,4 @@
-/* $Id: create.c,v 1.5 2001/08/26 17:28:00 ekohl Exp $
+/* $Id: create.c,v 1.6 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -19,85 +19,75 @@
 #define NDEBUG
 #include <internal/debug.h>
 
-static
-NTSTATUS STDCALL VerifyCreateParameters (
-	IN	PHANDLE			PortHandle,
-	IN	POBJECT_ATTRIBUTES	ObjectAttributes,
-	IN	ULONG			MaxConnectInfoLength,
-	IN	ULONG			MaxDataLength,
-	IN	ULONG			Reserved
-	)
+STATIC NTSTATUS STDCALL 
+VerifyCreateParameters (IN	PHANDLE			PortHandle,
+			IN	POBJECT_ATTRIBUTES	ObjectAttributes,
+			IN	ULONG			MaxConnectInfoLength,
+			IN	ULONG			MaxDataLength,
+			IN	ULONG			Reserved)
 {
-	if (NULL == PortHandle)
-	{
-		return (STATUS_INVALID_PARAMETER_1);
-	}
-	if (NULL == ObjectAttributes)
-	{
-		return (STATUS_INVALID_PARAMETER_2);
-	}
-	if (	(ObjectAttributes->Attributes    & OBJ_OPENLINK)
-		|| (ObjectAttributes->Attributes & OBJ_OPENIF)
-		|| (ObjectAttributes->Attributes & OBJ_EXCLUSIVE)
-		|| (ObjectAttributes->Attributes & OBJ_PERMANENT)
-		|| (ObjectAttributes->Attributes & OBJ_INHERIT)
-//		|| (ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE)
-		)
-	{
-		return (STATUS_INVALID_PORT_ATTRIBUTES);
-	}
-	if (MaxConnectInfoLength > 0x104) /* FIXME: use a macro! */
-	{
-		return (STATUS_INVALID_PARAMETER_3);
-	}
-	if (MaxDataLength > 0x148) /* FIXME: use a macro! */
-	{
-		return (STATUS_INVALID_PARAMETER_4);
-	}
-	/* FIXME: some checking is done also on Reserved */
-	return (STATUS_SUCCESS);
+  if (NULL == PortHandle)
+    {
+      return (STATUS_INVALID_PARAMETER_1);
+    }
+  if (NULL == ObjectAttributes)
+    {
+      return (STATUS_INVALID_PARAMETER_2);
+    }
+  if ((ObjectAttributes->Attributes    & OBJ_OPENLINK)
+      || (ObjectAttributes->Attributes & OBJ_OPENIF)
+      || (ObjectAttributes->Attributes & OBJ_EXCLUSIVE)
+      || (ObjectAttributes->Attributes & OBJ_PERMANENT)
+      || (ObjectAttributes->Attributes & OBJ_INHERIT))
+  {
+    return (STATUS_INVALID_PORT_ATTRIBUTES);
+  }
+  if (MaxConnectInfoLength > 0x104) /* FIXME: use a macro! */
+    {
+      return (STATUS_INVALID_PARAMETER_3);
+    }
+  if (MaxDataLength > 0x148) /* FIXME: use a macro! */
+    {
+      return (STATUS_INVALID_PARAMETER_4);
+    }
+  /* FIXME: some checking is done also on Reserved */
+  return (STATUS_SUCCESS);
 }
 
 
 NTSTATUS STDCALL
-NiCreatePort (
-	PVOID			ObjectBody,
-	PVOID			Parent,
-	PWSTR			RemainingPath,
-	POBJECT_ATTRIBUTES	ObjectAttributes
-	)
+NiCreatePort (PVOID			ObjectBody,
+	      PVOID			Parent,
+	      PWSTR			RemainingPath,
+	      POBJECT_ATTRIBUTES	ObjectAttributes)
 {
-	NTSTATUS	Status;
+  NTSTATUS	Status;
+  
+  if (RemainingPath == NULL)
+    {
+      return (STATUS_SUCCESS);
+    }
+  
+  if (wcschr(RemainingPath+1, '\\') != NULL)
+    {
+      return (STATUS_UNSUCCESSFUL);
+    }
+  
+  Status = ObReferenceObjectByPointer (Parent,
+				       STANDARD_RIGHTS_REQUIRED,
+				       ObDirectoryType,
+				       UserMode);
+  if (!NT_SUCCESS(Status))
+    {
+      return (Status);
+    }
+  
+  ObAddEntryDirectory (Parent,
+		       ObjectBody,
+		       (RemainingPath + 1));
+  ObDereferenceObject (Parent);
    
-	if (RemainingPath == NULL)
-	{
-		return (STATUS_SUCCESS);
-	}
-
-	if (wcschr(RemainingPath+1, '\\') != NULL)
-	{
-		return (STATUS_UNSUCCESSFUL);
-	}
-   
-	Status = ObReferenceObjectByPointer (
-			Parent,
-			STANDARD_RIGHTS_REQUIRED,
-			ObDirectoryType,
-			UserMode
-			);
-	if (!NT_SUCCESS(Status))
-	{
-		return (Status);
-	}
-   
-	ObAddEntryDirectory (
-		Parent,
-		ObjectBody,
-		(RemainingPath + 1)
-		);
-	ObDereferenceObject (Parent);
-   
-	return (STATUS_SUCCESS);
+  return (STATUS_SUCCESS);
 }
 
 
@@ -117,54 +107,46 @@ NiCreatePort (
  * RETURN VALUE
  * 
  */
-EXPORTED
-NTSTATUS
-STDCALL
-NtCreatePort (
-	PHANDLE			PortHandle,
-	POBJECT_ATTRIBUTES	ObjectAttributes,
-	ULONG			MaxConnectInfoLength,
-	ULONG			MaxDataLength,
-	ULONG			Reserved
-	)
+EXPORTED NTSTATUS STDCALL 
+NtCreatePort (PHANDLE		      PortHandle,
+	      POBJECT_ATTRIBUTES    ObjectAttributes,
+	      ULONG	       MaxConnectInfoLength,
+	      ULONG			MaxDataLength,
+	      ULONG			Reserved)
 {
-	PEPORT		Port;
-	NTSTATUS	Status;
-   
-	DPRINT("NtCreatePort() Name %x\n", ObjectAttributes->ObjectName->Buffer);
-
-	/* Verify parameters */
-	Status = VerifyCreateParameters (
-			PortHandle,
-			ObjectAttributes,
-			MaxConnectInfoLength,
-			MaxDataLength,
-			Reserved
-			);
-	if (!NT_SUCCESS(Status))
-	{
-		return (Status);
-	}
-	/* Ask Ob to create the object */
-	Status = ObCreateObject (
-			PortHandle,
-			PORT_ALL_ACCESS,
-			ObjectAttributes,
-			ExPortType,
-			(PVOID*)&Port
-			);
-	if (!NT_SUCCESS(Status))
-	{
-		return (Status);
-	}
-   
-	Status = NiInitializePort (Port);
-	Port->MaxConnectInfoLength = 260; /* FIXME: use a macro! */
-	Port->MaxDataLength = 328; /* FIXME: use a macro! */
-   
-	ObDereferenceObject (Port);
-   
-	return (Status);
+  PEPORT		Port;
+  NTSTATUS	Status;
+  
+  DPRINT("NtCreatePort() Name %x\n", ObjectAttributes->ObjectName->Buffer);
+  
+  /* Verify parameters */
+  Status = VerifyCreateParameters (PortHandle,
+				   ObjectAttributes,
+				   MaxConnectInfoLength,
+				   MaxDataLength,
+				   Reserved);
+  if (!NT_SUCCESS(Status))
+    {
+      return (Status);
+    }
+  /* Ask Ob to create the object */
+  Status = ObCreateObject (PortHandle,
+			   PORT_ALL_ACCESS,
+			   ObjectAttributes,
+			   ExPortType,
+			   (PVOID*)&Port);
+  if (!NT_SUCCESS(Status))
+    {
+      return (Status);
+    }
+  
+  Status = NiInitializePort (Port);
+  Port->MaxConnectInfoLength = 260; /* FIXME: use a macro! */
+  Port->MaxDataLength = 328; /* FIXME: use a macro! */
+  
+  ObDereferenceObject (Port);
+  
+  return (Status);
 }
 
 /**********************************************************************
@@ -187,33 +169,27 @@ NtCreatePort (
  * RETURN VALUE
  * 
  */
-EXPORTED
-NTSTATUS
-STDCALL
-NtCreateWaitablePort (
-	OUT	PHANDLE			PortHandle,
-	IN	POBJECT_ATTRIBUTES	ObjectAttributes,
-	IN	ULONG			MaxConnectInfoLength,
-	IN	ULONG			MaxDataLength,
-	IN	ULONG			Reserved
-	)
+EXPORTED NTSTATUS STDCALL
+NtCreateWaitablePort (OUT	PHANDLE			PortHandle,
+		      IN	POBJECT_ATTRIBUTES	ObjectAttributes,
+		      IN	ULONG			MaxConnectInfoLength,
+		      IN	ULONG			MaxDataLength,
+		      IN	ULONG			Reserved)
 {
-	NTSTATUS Status;
-
-	/* Verify parameters */
-	Status = VerifyCreateParameters (
-			PortHandle,
-			ObjectAttributes,
-			MaxConnectInfoLength,
-			MaxDataLength,
-			Reserved
-			);
-	if (STATUS_SUCCESS != Status)
-	{
-		return (Status);
-	}
-	/* TODO */
-	return (STATUS_NOT_IMPLEMENTED);
+  NTSTATUS Status;
+  
+  /* Verify parameters */
+  Status = VerifyCreateParameters (PortHandle,
+				   ObjectAttributes,
+				   MaxConnectInfoLength,
+				   MaxDataLength,
+				   Reserved);
+  if (STATUS_SUCCESS != Status)
+    {
+      return (Status);
+    }
+  /* TODO */
+  return (STATUS_NOT_IMPLEMENTED);
 }
 
 /* EOF */
diff --git a/reactos/ntoskrnl/lpc/listen.c b/reactos/ntoskrnl/lpc/listen.c
index bcd8bda0db5..5c2583b287c 100644
--- a/reactos/ntoskrnl/lpc/listen.c
+++ b/reactos/ntoskrnl/lpc/listen.c
@@ -1,4 +1,4 @@
-/* $Id: listen.c,v 1.2 2000/10/22 16:36:51 ekohl Exp $
+/* $Id: listen.c,v 1.3 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -9,7 +9,7 @@
  *                  Created 22/05/98
  */
 
-/* INCLUDES *****************************************************************/
+/* INCLUDES ******************************************************************/
 
 #include <ddk/ntddk.h>
 #include <internal/ob.h>
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 /**********************************************************************
  * NAME							EXPORTED
@@ -43,42 +44,35 @@
  * NOTE
  * 	
  */
-EXPORTED
-NTSTATUS
-STDCALL
-NtListenPort (
-	IN	HANDLE		PortHandle,
-	IN	PLPC_MESSAGE	ConnectMsg
-	)
+EXPORTED NTSTATUS STDCALL
+NtListenPort (IN	HANDLE		PortHandle,
+	      IN	PLPC_MESSAGE	ConnectMsg)
 {
-	NTSTATUS	Status;
-
-	/*
-	 * Wait forever for a connection request.
-	 */
-	for (;;)
+  NTSTATUS	Status;
+  
+  /*
+   * Wait forever for a connection request.
+   */
+  for (;;)
+    {
+      Status = NtReplyWaitReceivePort(PortHandle,
+				      NULL,
+				      NULL,
+				      ConnectMsg);
+      /*
+       * Accept only LPC_CONNECTION_REQUEST requests.
+       * Drop any other message.
+       */
+      if (!NT_SUCCESS(Status) || 
+	  LPC_CONNECTION_REQUEST == ConnectMsg->MessageType)
 	{
-		Status = NtReplyWaitReceivePort (
-				PortHandle,
-				NULL,
-				NULL,
-				ConnectMsg
-				);
-		/*
-		 * Accept only LPC_CONNECTION_REQUEST requests.
-		 * Drop any other message.
-		 */
-		if (	!NT_SUCCESS(Status)
-			|| (LPC_CONNECTION_REQUEST == ConnectMsg->MessageType)
-			)
-		{
-			DPRINT("Got message (type %x)\n", LPC_CONNECTION_REQUEST);
-			break;
-		}
-		DPRINT("Got message (type %x)\n", ConnectMsg->MessageType);
+	  DPRINT("Got message (type %x)\n", LPC_CONNECTION_REQUEST);
+	  break;
 	}
-
-	return (Status);
+      DPRINT("Got message (type %x)\n", ConnectMsg->MessageType);
+    }
+  
+  return (Status);
 }
 
 
diff --git a/reactos/ntoskrnl/lpc/port.c b/reactos/ntoskrnl/lpc/port.c
index ea2db562c15..c56824b3f4c 100644
--- a/reactos/ntoskrnl/lpc/port.c
+++ b/reactos/ntoskrnl/lpc/port.c
@@ -1,4 +1,4 @@
-/* $Id: port.c,v 1.6 2001/06/23 19:13:33 phreak Exp $
+/* $Id: port.c,v 1.7 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -85,23 +85,20 @@ NTSTATUS NiInitPort (VOID)
  *	STATUS_SUCCESS if initialization succedeed. An error code
  *	otherwise.
  */
-NTSTATUS
-STDCALL
-NiInitializePort (
-	IN OUT	PEPORT	Port
-	)
+NTSTATUS STDCALL
+NiInitializePort (IN OUT	PEPORT	Port)
 {
-	memset (Port, 0, sizeof(EPORT));
-	KeInitializeSpinLock (& Port->Lock);
-	KeInitializeSemaphore( &Port->Semaphore, 0, LONG_MAX );
-	Port->OtherPort = NULL;
-	Port->QueueLength = 0;
-	Port->ConnectQueueLength = 0;
-	Port->State = EPORT_INACTIVE;
-	InitializeListHead (& Port->QueueListHead);
-	InitializeListHead (& Port->ConnectQueueListHead);
+  memset (Port, 0, sizeof(EPORT));
+  KeInitializeSpinLock (& Port->Lock);
+  KeInitializeSemaphore( &Port->Semaphore, 0, LONG_MAX );
+  Port->OtherPort = NULL;
+  Port->QueueLength = 0;
+  Port->ConnectQueueLength = 0;
+  Port->State = EPORT_INACTIVE;
+  InitializeListHead (& Port->QueueListHead);
+  InitializeListHead (& Port->ConnectQueueListHead);
    
-	return (STATUS_SUCCESS);
+  return (STATUS_SUCCESS);
 }
 
 
@@ -121,14 +118,11 @@ NiInitializePort (
  * RETURN VALUE
  * 
  */
-NTSTATUS
-STDCALL
-NtImpersonateClientOfPort (
-	HANDLE		PortHandle,
-	PLPC_MESSAGE	ClientMessage
-	)
+NTSTATUS STDCALL
+NtImpersonateClientOfPort (HANDLE		PortHandle,
+			   PLPC_MESSAGE	ClientMessage)
 {
-	UNIMPLEMENTED;
+  UNIMPLEMENTED;
 }
 
 
diff --git a/reactos/ntoskrnl/lpc/query.c b/reactos/ntoskrnl/lpc/query.c
index e4769d1626c..2bc0cff564f 100644
--- a/reactos/ntoskrnl/lpc/query.c
+++ b/reactos/ntoskrnl/lpc/query.c
@@ -1,4 +1,4 @@
-/* $Id: query.c,v 1.2 2000/10/22 16:36:51 ekohl Exp $
+/* $Id: query.c,v 1.3 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 /**********************************************************************
  * NAME							EXPORTED
@@ -41,38 +42,32 @@
  * 	P. Dabak reports that this system service seems to return
  * 	no information.
  */
-EXPORTED
-NTSTATUS
-STDCALL
-NtQueryInformationPort (
-	IN	HANDLE	PortHandle,
-	IN	CINT	PortInformationClass,	
-	OUT	PVOID	PortInformation,    
-	IN	ULONG	PortInformationLength,
-	OUT	PULONG	ReturnLength
-	)
+EXPORTED NTSTATUS STDCALL
+NtQueryInformationPort (IN	HANDLE	PortHandle,
+			IN	CINT	PortInformationClass,	
+			OUT	PVOID	PortInformation,    
+			IN	ULONG	PortInformationLength,
+			OUT	PULONG	ReturnLength)
 {
-	NTSTATUS	Status;
-	PEPORT		Port;
-	
-	Status = ObReferenceObjectByHandle (
-			PortHandle,
-			PORT_ALL_ACCESS,   /* AccessRequired */
-			ExPortType,
-			UserMode,
-			(PVOID *) & Port,
-			NULL
-			);
-	if (!NT_SUCCESS(Status))
-	{
-		DPRINT("NtQueryInformationPort() = %x\n", Status);
-		return (Status);
-	}
-	/*
-	 * FIXME: NT does nothing here!
-	 */
-	ObDereferenceObject (Port);
-	return STATUS_SUCCESS;
+  NTSTATUS	Status;
+  PEPORT		Port;
+  
+  Status = ObReferenceObjectByHandle (PortHandle,
+				      PORT_ALL_ACCESS,   /* AccessRequired */
+				      ExPortType,
+				      UserMode,
+				      (PVOID *) & Port,
+				      NULL);
+  if (!NT_SUCCESS(Status))
+    {
+      DPRINT("NtQueryInformationPort() = %x\n", Status);
+      return (Status);
+    }
+  /*
+   * FIXME: NT does nothing here!
+   */
+  ObDereferenceObject (Port);
+  return STATUS_SUCCESS;
 }
 
 
diff --git a/reactos/ntoskrnl/lpc/queue.c b/reactos/ntoskrnl/lpc/queue.c
index 5674be39edd..8c17296acd3 100644
--- a/reactos/ntoskrnl/lpc/queue.c
+++ b/reactos/ntoskrnl/lpc/queue.c
@@ -1,4 +1,4 @@
-/* $Id: queue.c,v 1.4 2001/11/25 15:21:10 dwelch Exp $
+/* $Id: queue.c,v 1.5 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 VOID STDCALL
 EiEnqueueMessagePort (IN OUT	PEPORT		Port,
diff --git a/reactos/ntoskrnl/lpc/receive.c b/reactos/ntoskrnl/lpc/receive.c
index 377d9e4c94b..f6c3b77897f 100644
--- a/reactos/ntoskrnl/lpc/receive.c
+++ b/reactos/ntoskrnl/lpc/receive.c
@@ -1,4 +1,4 @@
-/* $Id: receive.c,v 1.2 2000/10/22 16:36:51 ekohl Exp $
+/* $Id: receive.c,v 1.3 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -19,6 +19,7 @@
 #define NDEBUG
 #include <internal/debug.h>
 
+/* FUNCTIONS *****************************************************************/
 
 /**********************************************************************
  * NAME							SYSTEM
@@ -30,16 +31,13 @@
  * RETURN VALUE
  *
  */
-NTSTATUS
-STDCALL
-NtReadRequestData (
-	HANDLE		PortHandle,
-	PLPC_MESSAGE	Message,
-	ULONG		Index,
-	PVOID		Buffer,
-	ULONG		BufferLength,
-	PULONG		Returnlength
-	)
+NTSTATUS STDCALL
+NtReadRequestData (HANDLE		PortHandle,
+		   PLPC_MESSAGE	Message,
+		   ULONG		Index,
+		   PVOID		Buffer,
+		   ULONG		BufferLength,
+		   PULONG		Returnlength)
 {
 	UNIMPLEMENTED;
 }
diff --git a/reactos/ntoskrnl/lpc/reply.c b/reactos/ntoskrnl/lpc/reply.c
index 0470336be4a..af1631394a6 100644
--- a/reactos/ntoskrnl/lpc/reply.c
+++ b/reactos/ntoskrnl/lpc/reply.c
@@ -1,4 +1,4 @@
-/* $Id: reply.c,v 1.8 2001/11/25 15:21:10 dwelch Exp $
+/* $Id: reply.c,v 1.9 2001/12/02 23:34:42 dwelch Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -112,7 +112,7 @@ NtReplyPort (IN	HANDLE		PortHandle,
 				 LpcReply, 
 				 LPC_REPLY,
 				 Port);
-   KeReleaseSemaphore( &Port->OtherPort->Semaphore, IO_NO_INCREMENT, 1, FALSE );
+   KeReleaseSemaphore(&Port->OtherPort->Semaphore, IO_NO_INCREMENT, 1, FALSE);
    
    ObDereferenceObject(Port);
    
@@ -170,9 +170,10 @@ NtReplyWaitReceivePortEx(IN  HANDLE		PortHandle,
      }
    if( Port->State == EPORT_DISCONNECTED )
      {
-       // if the port is disconnected, force the timeout to be 0
-       // so we don't wait for new messages, because there won't be
-       // any, only try to remove any existing messages
+       /* If the port is disconnected, force the timeout to be 0
+        * so we don't wait for new messages, because there won't be
+        * any, only try to remove any existing messages
+	*/
        Disconnected = TRUE;
        to.QuadPart = 0;
        Timeout = &to;
@@ -188,7 +189,8 @@ NtReplyWaitReceivePortEx(IN  HANDLE		PortHandle,
 				      LpcReply,
 				      LPC_REPLY,
 				      Port);
-	KeReleaseSemaphore( &Port->OtherPort->Semaphore, IO_NO_INCREMENT, 1, FALSE);
+	KeReleaseSemaphore(&Port->OtherPort->Semaphore, IO_NO_INCREMENT, 1, 
+			   FALSE);
 	
 	if (!NT_SUCCESS(Status))
 	  {
@@ -208,16 +210,18 @@ NtReplyWaitReceivePortEx(IN  HANDLE		PortHandle,
 				  Timeout);
    if( Status == STATUS_TIMEOUT )
      {
-       // if the port is disconnected, and there are no remaining messages,
-       // return STATUS_PORT_DISCONNECTED
-       ObDereferenceObject( Port );
-       return Disconnected ? STATUS_PORT_DISCONNECTED : STATUS_TIMEOUT;
+       /*
+	* if the port is disconnected, and there are no remaining messages,
+        * return STATUS_PORT_DISCONNECTED
+	*/
+       ObDereferenceObject(Port);
+       return(Disconnected ? STATUS_PORT_DISCONNECTED : STATUS_TIMEOUT);
      }
    
    if (!NT_SUCCESS(Status))
      {
        DPRINT1("NtReplyWaitReceivePortEx() = %x\n", Status);
-       ObDereferenceObject( Port );
+       ObDereferenceObject(Port);
        return(Status);
      }
 
@@ -227,14 +231,34 @@ NtReplyWaitReceivePortEx(IN  HANDLE		PortHandle,
    KeAcquireSpinLock(&Port->Lock, &oldIrql);
    Request = EiDequeueMessagePort(Port);
    
-   assert( Request );
-   Status = MmCopyToCaller(LpcMessage, &Request->Message,
-			   Request->Message.MessageSize);
+   if (Request->Message.MessageType == LPC_CONNECTION_REQUEST)
+     {
+       LPC_MESSAGE_HEADER Header;
+       PEPORT_CONNECT_REQUEST_MESSAGE CRequest;
+
+       CRequest = (PEPORT_CONNECT_REQUEST_MESSAGE)&Request->Message;
+       memcpy(&Header, &Request->Message, sizeof(LPC_MESSAGE_HEADER));
+       Header.DataSize = CRequest->ConnectDataLength;
+       Header.MessageSize = Header.DataSize + sizeof(LPC_MESSAGE_HEADER);
+       Status = MmCopyToCaller(LpcMessage, &Header, sizeof(LPC_MESSAGE));
+       if (!NT_SUCCESS(Status))
+	 {
+	   Status = MmCopyToCaller((PVOID)(LpcMessage + 1),
+				   CRequest->ConnectData,
+				   CRequest->ConnectDataLength);
+	 }
+     }
+   else
+     {
+       Status = MmCopyToCaller(LpcMessage, &Request->Message,
+			       Request->Message.MessageSize);
+     }
    if (!NT_SUCCESS(Status))
      {
        /*
 	* Copying the message to the caller's buffer failed so 
 	* undo what we did and return.
+	* FIXME: Also increment semaphore.
 	*/
        EiEnqueueMessageAtHeadPort(Port, Request);
        KeReleaseSpinLock(&Port->Lock, oldIrql);
@@ -284,13 +308,11 @@ NtReplyWaitReceivePort (IN  HANDLE		PortHandle,
 			IN  PLPC_MESSAGE	LpcReply,     
 			OUT PLPC_MESSAGE	LpcMessage)
 {
-	return NtReplyWaitReceivePortEx (
-			PortHandle,
-			PortId,
-			LpcReply,
-			LpcMessage,
-			NULL
-			);
+  return(NtReplyWaitReceivePortEx (PortHandle,
+				   PortId,
+				   LpcReply,
+				   LpcMessage,
+				   NULL));
 }
 
 /**********************************************************************
diff --git a/reactos/ntoskrnl/mm/section.c b/reactos/ntoskrnl/mm/section.c
index f8539e20ea1..9dc6cccaab4 100644
--- a/reactos/ntoskrnl/mm/section.c
+++ b/reactos/ntoskrnl/mm/section.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: section.c,v 1.66 2001/11/13 22:46:49 ekohl Exp $
+/* $Id: section.c,v 1.67 2001/12/02 23:34:42 dwelch Exp $
  *
  * PROJECT:         ReactOS kernel
  * FILE:            ntoskrnl/mm/section.c
@@ -376,7 +376,6 @@ MmNotPresentFaultSectionView(PMADDRESS_SPACE AddressSpace,
    ULONG Entry1;
    ULONG Attributes;
    PMM_PAGEOP PageOp;
-   PVOID NewAddress;
    
    /*
     * There is a window between taking the page fault and locking the
@@ -525,7 +524,8 @@ MmNotPresentFaultSectionView(PMADDRESS_SPACE AddressSpace,
    /*
     * Map anonymous memory for BSS sections
     */
-   if (Segment->Characteristics & IMAGE_SECTION_CHAR_BSS)
+   if (Segment->Characteristics & IMAGE_SECTION_CHAR_BSS ||
+       Segment->Flags & MM_PAGEFILE_SECTION)
      {
        Page = MmAllocPage(0);
        while (Page == NULL)
@@ -540,11 +540,6 @@ MmNotPresentFaultSectionView(PMADDRESS_SPACE AddressSpace,
 	    Page = MmAllocPage(0);
 	 }
 
-       // clear the page	
-       NewAddress = ExAllocatePageWithPhysPage((ULONG)Page);
-       memset(NewAddress, 0, PAGESIZE);
-       ExUnmapPage(NewAddress);
-
        Status = MmCreateVirtualMapping(PsGetCurrentProcess(),
 				       Address,
 				       MemoryArea->Attributes,
@@ -1713,6 +1708,7 @@ MmMapViewOfSegment(PEPROCESS Process,
   PMEMORY_AREA MArea;
   NTSTATUS Status;
   KIRQL oldIrql;
+
   MmLockAddressSpace(&Process->AddressSpace);
   Status = MmCreateMemoryArea(Process,
 			      &Process->AddressSpace,
diff --git a/reactos/subsys/csrss/api.h b/reactos/subsys/csrss/api.h
index d1aea48e556..aedf9414269 100644
--- a/reactos/subsys/csrss/api.h
+++ b/reactos/subsys/csrss/api.h
@@ -74,11 +74,13 @@ typedef struct CSRSS_CONSOLE_t
 
 typedef struct
 {
-   PCSRSS_CONSOLE Console;
-   ULONG HandleTableSize;
-   Object_t ** HandleTable;
-   ULONG ProcessId;
-   HANDLE ConsoleEvent;
+  PCSRSS_CONSOLE Console;
+  ULONG HandleTableSize;
+  Object_t ** HandleTable;
+  ULONG ProcessId;
+  HANDLE ConsoleEvent;
+  PVOID CsrSectionViewBase;
+  ULONG CsrSectionViewSize;
 } CSRSS_PROCESS_DATA, *PCSRSS_PROCESS_DATA;
 
 #define CSR_API(n) NTSTATUS n (\
diff --git a/reactos/subsys/csrss/api/conio.c b/reactos/subsys/csrss/api/conio.c
index d4a6c076dcc..7aeefc61bf4 100644
--- a/reactos/subsys/csrss/api/conio.c
+++ b/reactos/subsys/csrss/api/conio.c
@@ -1,4 +1,4 @@
-/* $Id: conio.c,v 1.26 2001/11/20 02:29:45 dwelch Exp $
+/* $Id: conio.c,v 1.27 2001/12/02 23:34:43 dwelch Exp $
  *
  * reactos/subsys/csrss/api/conio.c
  *
@@ -1689,6 +1689,7 @@ CSR_API(CsrWriteConsoleOutput)
    COORD BufferSize;
    NTSTATUS Status;
    DWORD Offset;
+   DWORD PSize;
 
    Reply->Header.MessageSize = sizeof(CSRSS_API_REPLY);
    Reply->Header.DataSize = sizeof(CSRSS_API_REPLY) - sizeof(LPC_MESSAGE_HEADER);
@@ -1702,8 +1703,17 @@ CSR_API(CsrWriteConsoleOutput)
       }
 
    BufferSize = Request->Data.WriteConsoleOutputRequest.BufferSize;
+   PSize = BufferSize.X * BufferSize.Y * sizeof(CHAR_INFO);
    BufferCoord = Request->Data.WriteConsoleOutputRequest.BufferCoord;
-   CharInfo = (CHAR_INFO*)&Request->Data.WriteConsoleOutputRequest.CharInfo;
+   CharInfo = Request->Data.WriteConsoleOutputRequest.CharInfo;
+   if (((PVOID)CharInfo < ProcessData->CsrSectionViewBase) ||
+       (((PVOID)CharInfo + PSize) > 
+	(ProcessData->CsrSectionViewBase + ProcessData->CsrSectionViewSize)))
+     {
+       UNLOCK;
+       Reply->Status = STATUS_ACCESS_VIOLATION;
+       return(Reply->Status);
+     }
    WriteRegion = Request->Data.WriteConsoleOutputRequest.WriteRegion;
 
    SizeY = RtlMin(BufferSize.Y - BufferCoord.Y, CsrpRectHeight(WriteRegion));
diff --git a/reactos/subsys/csrss/api/wapi.c b/reactos/subsys/csrss/api/wapi.c
index 3d73ec662a4..f78796bebd0 100644
--- a/reactos/subsys/csrss/api/wapi.c
+++ b/reactos/subsys/csrss/api/wapi.c
@@ -1,4 +1,4 @@
-/* $Id: wapi.c,v 1.15 2001/09/01 15:36:45 chorns Exp $
+/* $Id: wapi.c,v 1.16 2001/12/02 23:34:43 dwelch Exp $
  * 
  * reactos/subsys/csrss/api/wapi.c
  *
@@ -113,11 +113,14 @@ void Thread_Api(PVOID PortHandle)
    LPC_MAX_MESSAGE Request;
    HANDLE ServerPort;
    HANDLE ServerThread;
+   PCSRSS_PROCESS_DATA ProcessData;
    
    CsrInitProcessData();
    
    for (;;)
      {
+       LPC_SECTION_READ LpcRead;
+
 	Status = NtListenPort(PortHandle, &Request.Header);
 	if (!NT_SUCCESS(Status))
 	  {
@@ -130,12 +133,16 @@ void Thread_Api(PVOID PortHandle)
 				     NULL,
 				     1,
 				     0,
-				     NULL);
+				     &LpcRead);
 	if (!NT_SUCCESS(Status))
 	  {
 	     DisplayString(L"CSR: NtAcceptConnectPort() failed\n");
 	     NtTerminateThread(NtCurrentThread(), Status);
 	  }
+
+	ProcessData = CsrGetProcessData(Request.Header.Cid.UniqueProcess);
+	ProcessData->CsrSectionViewBase = LpcRead.ViewBase;
+	ProcessData->CsrSectionViewSize = LpcRead.ViewSize;
 	
 	Status = NtCompleteConnectPort(ServerPort);
 	if (!NT_SUCCESS(Status))
diff --git a/reactos/subsys/smss/init.c b/reactos/subsys/smss/init.c
index e9cac3e219a..3adff072574 100644
--- a/reactos/subsys/smss/init.c
+++ b/reactos/subsys/smss/init.c
@@ -1,4 +1,4 @@
-/* $Id: init.c,v 1.26 2001/07/15 13:46:16 ekohl Exp $
+/* $Id: init.c,v 1.27 2001/12/02 23:34:43 dwelch Exp $
  *
  * init.c - Session Manager initialization
  * 
@@ -448,7 +448,7 @@ BOOL InitSessionManager (HANDLE	Children[])
    /* Load the kernel mode driver win32k.sys */
    RtlInitUnicodeString (&CmdLineW,
 			 L"\\SystemRoot\\system32\\drivers\\win32k.sys");
-   Status = NtLoadDriver (&CmdLineW);
+   //   Status = NtLoadDriver (&CmdLineW);
    
 #if 0
    if (!NT_SUCCESS(Status))