* Sync up to trunk head (r64959).

svn path=/branches/shell-experiments/; revision=64961

boot/freeldr/freeldr/arch/i386/i386bug.c

@@ -108,8 +108,7 @@ i386PrintExceptionText(ULONG TrapIndex, PKTRAP_FRAME TrapFrame, PKSPECIAL_REGIST
     i386_ScreenPosX = 0;
     i386_ScreenPosY = 0;
 
-    PrintText("An error occured in FreeLoader\n"
+    PrintText("An error occured in " VERSION "\n"
-              VERSION"\n"
               "Report this error to the ReactOS Development mailing list <ros-dev@reactos.org>\n\n"
               "0x%02lx: %s\n", TrapIndex, i386ExceptionDescriptionText[TrapIndex]);
 #ifdef _M_IX86

boot/freeldr/freeldr/arch/i386/pcmem.c

@@ -32,7 +32,6 @@ DBG_DEFAULT_CHANNEL(MEMORY);
 #define STACK_BASE_PAGE    (STACKLOW / PAGE_SIZE)
 #define FREELDR_BASE_PAGE  (FREELDR_BASE / PAGE_SIZE)
 #define DISKBUF_BASE_PAGE  (DISKREADBUFFER / PAGE_SIZE)
-#define BIOSBUF_BASE_PAGE  (BIOSCALLBUFFER / PAGE_SIZE)
 
 #define STACK_PAGE_COUNT   (FREELDR_BASE_PAGE - STACK_BASE_PAGE)
 #define FREELDR_PAGE_COUNT (DISKBUF_BASE_PAGE - FREELDR_BASE_PAGE)
@@ -45,11 +44,10 @@ ULONG PcBiosMapCount;
 FREELDR_MEMORY_DESCRIPTOR PcMemoryMap[MAX_BIOS_DESCRIPTORS + 1] =
 {
     { LoaderFirmwarePermanent, 0x00,               1 }, // realmode int vectors
-    { LoaderFirmwareTemporary, 0x01,               STACK_BASE_PAGE - 1 }, // freeldr stack + cmdline
+    { LoaderFirmwareTemporary, 0x01,               STACK_BASE_PAGE - 1 }, // freeldr stack, cmdline, BIOS call buffer
     { LoaderOsloaderStack,     STACK_BASE_PAGE,    FREELDR_BASE_PAGE - STACK_BASE_PAGE }, // prot mode stack.
     { LoaderLoadedProgram,     FREELDR_BASE_PAGE,  FREELDR_PAGE_COUNT }, // freeldr image
     { LoaderFirmwareTemporary, DISKBUF_BASE_PAGE,  DISKBUF_PAGE_COUNT }, // Disk read buffer for int 13h. DISKREADBUFFER
-    { LoaderFirmwareTemporary, BIOSBUF_BASE_PAGE,  BIOSBUF_PAGE_COUNT }, // BIOSCALLBUFFER
     { LoaderFirmwarePermanent, 0x9F,               0x1 },  // EBDA
     { LoaderFirmwarePermanent, 0xA0,               0x50 }, // ROM / Video
     { LoaderSpecialMemory,     0xF0,               0x10 }, // ROM / Video
@@ -203,13 +201,14 @@ PcMemGetBiosMemoryMap(PFREELDR_MEMORY_DESCRIPTOR MemoryMap, ULONG MaxMemoryMapSi
        bit value at address 0x413 inside the BDA, which gives us the usable size
        in KB */
     Size = (*(PUSHORT)(ULONG_PTR)0x413) * 1024;
-    if (Size < 0x9F000)
+    if (Size < MEMORY_MARGIN)
     {
         FrLdrBugCheckWithMessage(
             MEMORY_INIT_FAILURE,
             __FILE__,
             __LINE__,
-            "The BIOS reported a usable memory range up to 0x%x, which is too small!\n",
+            "The BIOS reported a usable memory range up to 0x%x, which is too small!\n\n"
+            "If you see this, please report to the ReactOS team!",
             Size);
     }
 
@@ -230,13 +229,13 @@ PcMemGetBiosMemoryMap(PFREELDR_MEMORY_DESCRIPTOR MemoryMap, ULONG MaxMemoryMapSi
     {
         /* Check if this is high enough */
         ULONG EbdaBase = (ULONG)Regs.w.es << 4;
-        if (EbdaBase < 0x9F000)
+        if (EbdaBase < MEMORY_MARGIN)
         {
             FrLdrBugCheckWithMessage(
                 MEMORY_INIT_FAILURE,
                 __FILE__,
                 __LINE__,
-                "The location of your EBDA is 0x%lx, which is too low!\n"
+                "The location of your EBDA is 0x%lx, which is too low!\n\n"
                 "If you see this, please report to the ReactOS team!",
                 EbdaBase);
         }

boot/freeldr/freeldr/include/arch/pc/x86common.h

@@ -9,6 +9,7 @@
 #define PDP_ADDRESS         HEX(2000) /* One page PDP page table */
 #define PD_ADDRESS          HEX(3000) /* One page PD page table */
 //#endif
+#define BIOSCALLBUFFER      HEX(4000) /* Buffer to store temporary data for any Int386() call */
 #define STACK16ADDR         HEX(6F00) /* The 16-bit stack top will be at 0000:6F00 */
 #define BSS_START           HEX(6F00)
 #define STACKLOW            HEX(7000)
@@ -16,7 +17,7 @@
 #define FREELDR_BASE        HEX(F800)
 #define FREELDR_PE_BASE    HEX(10000)
 #define DISKREADBUFFER     HEX(8E000) /* Buffer to store data read in from the disk via the BIOS */
-#define BIOSCALLBUFFER     HEX(9E000) /* Buffer to store temporary data for any Int386() call */
+#define MEMORY_MARGIN      HEX(9E000) /* Highest usable address */
 /* 9F000- 9FFFF is reserved for the EBDA */
 #define DISKREADBUFFER_SIZE HEX(10000)
 

dll/win32/advapi32/CMakeLists.txt

@@ -28,22 +28,21 @@ list(APPEND SOURCE
     reg/reg.c
     sec/ac.c
     sec/audit.c
-    sec/cred.c
     sec/lsa.c
     sec/misc.c
     sec/safer.c
     sec/sec.c
-    sec/sid.c
     sec/trustee.c
     service/eventlog.c
     service/rpc.c
     service/scm.c
     service/sctrl.c
-    token/privilege.c
     token/token.c
+    wine/cred.c
     wine/crypt.c
     wine/crypt_des.c
     wine/crypt_lmhash.c
+    wine/security.c
     advapi32.h)
 
 add_library(advapi32 SHARED

dll/win32/advapi32/token/privilege.c

@@ -1,41 +0,0 @@
-/*
- * COPYRIGHT:       See COPYING in the top level directory
- * PROJECT:         ReactOS system libraries
- * FILE:            lib/advapi32/token/privilege.c
- * PURPOSE:         advapi32.dll token's privilege handling
- * PROGRAMMER:      E.Aliberti
- * UPDATE HISTORY:
- *	20010317 ea	stubs
- */
-
-#include <advapi32.h>
-
-
-/**********************************************************************
- *	PrivilegeCheck					EXPORTED
- *
- * @implemented
- */
-BOOL WINAPI
-PrivilegeCheck(HANDLE ClientToken,
-               PPRIVILEGE_SET RequiredPrivileges,
-               LPBOOL pfResult)
-{
-    BOOLEAN Result;
-    NTSTATUS Status;
-
-    Status = NtPrivilegeCheck(ClientToken,
-                              RequiredPrivileges,
-                              &Result);
-    if (!NT_SUCCESS(Status))
-    {
-        SetLastError(RtlNtStatusToDosError(Status));
-        return FALSE;
-    }
-
-    *pfResult = (BOOL)Result;
-
-    return TRUE;
-}
-
-/* EOF */

media/doc/README.WINE

@@ -256,11 +256,11 @@ check Wine current souces first as it may already be fixed.
 reactos/lib/3rdparty/strmbase               # Synced to Wine-1.7.27
 
 advapi32 -
+  reactos/dll/win32/advapi32/wine/cred.c         # Synced to Wine-1.7.27
   reactos/dll/win32/advapi32/wine/crypt.c        # Synced to Wine-1.7.27
   reactos/dll/win32/advapi32/wine/crypt_des.c    # Synced to Wine-1.7.27
   reactos/dll/win32/advapi32/wine/crypt_lmhash.c # Synced to Wine-1.7.27
-  reactos/dll/win32/advapi32/sec/cred.c          # Synced to Wine-1.7.27
+  reactos/dll/win32/advapi32/wine/security.c     # Out of Sync
-  reactos/dll/win32/advapi32/sec/sid.c           # Out of Sync
 
 gdi32 -
   reactos/dll/win32/gdi32/objects/linedda.c     # Synced at 20090410

ntoskrnl/include/internal/io.h

@@ -1277,6 +1277,8 @@ extern ULONG IopNumTriageDumpDataBlocks;
 extern PVOID IopTriageDumpDataBlocks[64];
 extern PIO_BUS_TYPE_GUID_LIST PnpBusTypeGuidList;
 extern PDRIVER_OBJECT IopRootDriverObject;
+extern KSPIN_LOCK IopDeviceRelationsSpinLock;
+extern LIST_ENTRY IopDeviceRelationsRequestList;
 
 //
 // Inlined Functions

ntoskrnl/include/internal/tag.h

@@ -81,6 +81,9 @@
 /* formerly located in io/mdl.c */
 #define TAG_MDL    ' LDM'
 
+/* formerly located in io/pnpmgr.c */
+#define TAG_IO_DEVNODE 'donD'
+
 /* formerly located in io/pnpnotify.c */
 #define TAG_PNP_NOTIFY  'NPnP'
 

ntoskrnl/io/iomgr/driver.c

@@ -16,6 +16,8 @@
 
 /* GLOBALS ********************************************************************/
 
+ERESOURCE IopDriverLoadResource;
+
 LIST_ENTRY DriverReinitListHead;
 KSPIN_LOCK DriverReinitListLock;
 PLIST_ENTRY DriverReinitTailEntry;
@@ -113,6 +115,7 @@ IopGetDriverObject(
     DPRINT("IopGetDriverObject(%p '%wZ' %x)\n",
            DriverObject, ServiceName, FileSystem);
 
+    ASSERT(ExIsResourceAcquiredExclusiveLite(&IopDriverLoadResource));
     *DriverObject = NULL;
 
     /* Create ModuleName string */
@@ -239,39 +242,44 @@ IopNormalizeImagePath(
          PUNICODE_STRING ImagePath,
     _In_ PUNICODE_STRING ServiceName)
 {
+    UNICODE_STRING SystemRootString = RTL_CONSTANT_STRING(L"\\SystemRoot\\");
+    UNICODE_STRING DriversPathString = RTL_CONSTANT_STRING(L"\\SystemRoot\\system32\\drivers\\");
+    UNICODE_STRING DotSysString = RTL_CONSTANT_STRING(L".sys");
     UNICODE_STRING InputImagePath;
 
     DPRINT("Normalizing image path '%wZ' for service '%wZ'\n", ImagePath, ServiceName);
 
-    RtlCopyMemory(&InputImagePath,
+    InputImagePath = *ImagePath;
-                  ImagePath,
-                  sizeof(UNICODE_STRING));
-
     if (InputImagePath.Length == 0)
     {
         ImagePath->Length = 0;
-        ImagePath->MaximumLength =
+        ImagePath->MaximumLength = DriversPathString.Length +
-            (33 * sizeof(WCHAR)) + ServiceName->Length + sizeof(UNICODE_NULL);
+                                   ServiceName->Length +
-        ImagePath->Buffer = ExAllocatePool(NonPagedPool,
+                                   DotSysString.Length +
-                                           ImagePath->MaximumLength);
+                                   sizeof(UNICODE_NULL);
+        ImagePath->Buffer = ExAllocatePoolWithTag(NonPagedPool,
+                                                  ImagePath->MaximumLength,
+                                                  TAG_IO);
         if (ImagePath->Buffer == NULL)
             return STATUS_NO_MEMORY;
 
-        RtlAppendUnicodeToString(ImagePath, L"\\SystemRoot\\system32\\drivers\\");
+        RtlCopyUnicodeString(ImagePath, &DriversPathString);
         RtlAppendUnicodeStringToString(ImagePath, ServiceName);
-        RtlAppendUnicodeToString(ImagePath, L".sys");
+        RtlAppendUnicodeStringToString(ImagePath, &DotSysString);
     }
     else if (InputImagePath.Buffer[0] != L'\\')
     {
         ImagePath->Length = 0;
-        ImagePath->MaximumLength =
+        ImagePath->MaximumLength = SystemRootString.Length +
-            12 * sizeof(WCHAR) + InputImagePath.Length + sizeof(UNICODE_NULL);
+                                   InputImagePath.Length +
-        ImagePath->Buffer = ExAllocatePool(NonPagedPool,
+                                   sizeof(UNICODE_NULL);
-                                           ImagePath->MaximumLength);
+        ImagePath->Buffer = ExAllocatePoolWithTag(NonPagedPool,
+                                                  ImagePath->MaximumLength,
+                                                  TAG_IO);
         if (ImagePath->Buffer == NULL)
             return STATUS_NO_MEMORY;
 
-        RtlAppendUnicodeToString(ImagePath, L"\\SystemRoot\\");
+        RtlCopyUnicodeString(ImagePath, &SystemRootString);
         RtlAppendUnicodeStringToString(ImagePath, &InputImagePath);
 
         /* Free caller's string */
@@ -308,6 +316,7 @@ IopLoadServiceModule(
     HANDLE CCSKey, ServiceKey;
     PVOID BaseAddress;
 
+    ASSERT(ExIsResourceAcquiredExclusiveLite(&IopDriverLoadResource));
     ASSERT(ServiceName->Length);
     DPRINT("IopLoadServiceModule(%wZ, 0x%p)\n", ServiceName, ModuleObject);
 
@@ -319,8 +328,7 @@ IopLoadServiceModule(
         ServiceStart = 0;
 
         /* IopNormalizeImagePath will do all of the work for us if we give it an empty string */
-        ServiceImagePath.Length = ServiceImagePath.MaximumLength = 0;
+        RtlInitEmptyUnicodeString(&ServiceImagePath, NULL, 0);
-        ServiceImagePath.Buffer = NULL;
     }
     else
     {
@@ -563,6 +571,8 @@ IopAttachFilterDriversCallback(
         ServiceName.MaximumLength =
         ServiceName.Length = (USHORT)wcslen(Filters) * sizeof(WCHAR);
 
+        KeEnterCriticalRegion();
+        ExAcquireResourceExclusiveLite(&IopDriverLoadResource, TRUE);
         Status = IopGetDriverObject(&DriverObject,
                                     &ServiceName,
                                     FALSE);
@@ -571,7 +581,11 @@ IopAttachFilterDriversCallback(
             /* Load and initialize the filter driver */
             Status = IopLoadServiceModule(&ServiceName, &ModuleObject);
             if (!NT_SUCCESS(Status))
+            {
+                ExReleaseResourceLite(&IopDriverLoadResource);
+                KeLeaveCriticalRegion();
                 return Status;
+            }
 
             Status = IopInitializeDriverModule(DeviceNode,
                                                ModuleObject,
@@ -579,8 +593,15 @@ IopAttachFilterDriversCallback(
                                                FALSE,
                                                &DriverObject);
             if (!NT_SUCCESS(Status))
+            {
+                ExReleaseResourceLite(&IopDriverLoadResource);
+                KeLeaveCriticalRegion();
                 return Status;
             }
+        }
+
+        ExReleaseResourceLite(&IopDriverLoadResource);
+        KeLeaveCriticalRegion();
 
         Status = IopInitializeDevice(DeviceNode, DriverObject);
 
@@ -926,7 +947,6 @@ IopInitializeBuiltinDriver(IN PLDR_DATA_TABLE_ENTRY BootLdrEntry)
 
     if (!NT_SUCCESS(Status))
     {
-        IopFreeDeviceNode(DeviceNode);
         return Status;
     }
 
@@ -990,7 +1010,6 @@ IopInitializeBootDrivers(VOID)
     if (!NT_SUCCESS(Status))
     {
         /* Fail */
-        IopFreeDeviceNode(DeviceNode);
         return;
     }
 
@@ -999,7 +1018,6 @@ IopInitializeBootDrivers(VOID)
     if (!NT_SUCCESS(Status))
     {
         /* Fail */
-        IopFreeDeviceNode(DeviceNode);
         ObDereferenceObject(DriverObject);
         return;
     }
@@ -1009,7 +1027,6 @@ IopInitializeBootDrivers(VOID)
     if (!NT_SUCCESS(Status))
     {
         /* Fail */
-        IopFreeDeviceNode(DeviceNode);
         ObDereferenceObject(DriverObject);
         return;
     }
@@ -1971,6 +1988,8 @@ IopLoadUnloadDriver(
     DPRINT("FullImagePath: '%wZ'\n", &ImagePath);
     DPRINT("Type: %lx\n", Type);
 
+    KeEnterCriticalRegion();
+    ExAcquireResourceExclusiveLite(&IopDriverLoadResource, TRUE);
     /*
      * Get existing DriverObject pointer (in case the driver
      * has already been loaded and initialized).
@@ -1990,6 +2009,8 @@ IopLoadUnloadDriver(
         if (!NT_SUCCESS(Status))
         {
             DPRINT("MmLoadSystemImage() failed (Status %lx)\n", Status);
+            ExReleaseResourceLite(&IopDriverLoadResource);
+            KeLeaveCriticalRegion();
             return Status;
         }
 
@@ -2000,6 +2021,8 @@ IopLoadUnloadDriver(
         if (!NT_SUCCESS(Status))
         {
             DPRINT1("IopCreateDeviceNode() failed (Status %lx)\n", Status);
+            ExReleaseResourceLite(&IopDriverLoadResource);
+            KeLeaveCriticalRegion();
             MmUnloadSystemImage(ModuleObject);
             return Status;
         }
@@ -2015,17 +2038,24 @@ IopLoadUnloadDriver(
         if (!NT_SUCCESS(Status))
         {
             DPRINT1("IopInitializeDriverModule() failed (Status %lx)\n", Status);
+            ExReleaseResourceLite(&IopDriverLoadResource);
+            KeLeaveCriticalRegion();
             MmUnloadSystemImage(ModuleObject);
-            IopFreeDeviceNode(DeviceNode);
             return Status;
         }
 
+        ExReleaseResourceLite(&IopDriverLoadResource);
+        KeLeaveCriticalRegion();
+
         /* Initialize and start device */
         IopInitializeDevice(DeviceNode, *DriverObject);
         Status = IopStartDevice(DeviceNode);
     }
     else
     {
+        ExReleaseResourceLite(&IopDriverLoadResource);
+        KeLeaveCriticalRegion();
+
         DPRINT("DriverObject already exist in ObjectManager\n");
         Status = STATUS_IMAGE_ALREADY_LOADED;
 

ntoskrnl/io/iomgr/iomgr.c

@@ -54,6 +54,7 @@ extern KSPIN_LOCK ShutdownListLock;
 extern POBJECT_TYPE IoAdapterObjectType;
 extern ERESOURCE IopDatabaseResource;
 ERESOURCE IopSecurityResource;
+extern ERESOURCE IopDriverLoadResource;
 extern KGUARDED_MUTEX PnpNotifyListLock;
 extern LIST_ENTRY IopDiskFileSystemQueueHead;
 extern LIST_ENTRY IopCdRomFileSystemQueueHead;
@@ -476,8 +477,9 @@ IoInitSystem(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
     IopInitLookasideLists();
 
     /* Initialize all locks and lists */
-    ExInitializeResource(&IopDatabaseResource);
+    ExInitializeResourceLite(&IopDatabaseResource);
-    ExInitializeResource(&IopSecurityResource);
+    ExInitializeResourceLite(&IopSecurityResource);
+    ExInitializeResourceLite(&IopDriverLoadResource);
     KeInitializeGuardedMutex(&PnpNotifyListLock);
     InitializeListHead(&IopDiskFileSystemQueueHead);
     InitializeListHead(&IopCdRomFileSystemQueueHead);

ntoskrnl/io/iomgr/irp.c

@@ -324,6 +324,9 @@ IopCompleteRequest(IN PKAPC Apc,
             Key = FileObject->CompletionContext->Key;
         }
 
+        /* Check for UserIos */
+        if (Irp->UserIosb != NULL)
+        {
             /* Use SEH to make sure we don't write somewhere invalid */
             _SEH2_TRY
             {
@@ -335,6 +338,7 @@ IopCompleteRequest(IN PKAPC Apc,
                 /* Ignore any error */
             }
             _SEH2_END;
+        }
 
         /* Check if we have an event or a file object */
         if (Irp->UserEvent)

ntoskrnl/io/pnpmgr/pnpinit.c

@@ -385,6 +385,8 @@ IopInitializePlugPlayServices(VOID)
 
     /* Initialize locks and such */
     KeInitializeSpinLock(&IopDeviceTreeLock);
+    KeInitializeSpinLock(&IopDeviceRelationsSpinLock);
+    InitializeListHead(&IopDeviceRelationsRequestList);
 
     /* Get the default interface */
     PnpDefaultInterfaceType = IopDetermineDefaultInterfaceType();

ntoskrnl/io/pnpmgr/pnpmgr.c

@@ -21,6 +21,7 @@ ERESOURCE PpRegistryDeviceResource;
 KGUARDED_MUTEX PpDeviceReferenceTableLock;
 RTL_AVL_TABLE PpDeviceReferenceTable;
 
+extern ERESOURCE IopDriverLoadResource;
 extern ULONG ExpInitializationPhase;
 extern BOOLEAN ExpInTextModeSetup;
 extern BOOLEAN PnpSystemInit;
@@ -29,12 +30,16 @@ extern BOOLEAN PnpSystemInit;
 
 PDRIVER_OBJECT IopRootDriverObject;
 PIO_BUS_TYPE_GUID_LIST PnpBusTypeGuidList = NULL;
+LIST_ENTRY IopDeviceRelationsRequestList;
+WORK_QUEUE_ITEM IopDeviceRelationsWorkItem;
+BOOLEAN IopDeviceRelationsRequestInProgress;
+KSPIN_LOCK IopDeviceRelationsSpinLock;
 
 typedef struct _INVALIDATE_DEVICE_RELATION_DATA
 {
+    LIST_ENTRY RequestListEntry;
     PDEVICE_OBJECT DeviceObject;
     DEVICE_RELATION_TYPE Type;
-    PIO_WORKITEM WorkItem;
 } INVALIDATE_DEVICE_RELATION_DATA, *PINVALIDATE_DEVICE_RELATION_DATA;
 
 /* FUNCTIONS *****************************************************************/
@@ -889,20 +894,34 @@ IopQueryDeviceCapabilities(PDEVICE_NODE DeviceNode,
    return Status;
 }
 
-static VOID NTAPI
+static
-IopAsynchronousInvalidateDeviceRelations(
+VOID
-    IN PDEVICE_OBJECT DeviceObject,
+NTAPI
-    IN PVOID InvalidateContext)
+IopDeviceRelationsWorker(
+    _In_ PVOID Context)
 {
-    PINVALIDATE_DEVICE_RELATION_DATA Data = InvalidateContext;
+    PLIST_ENTRY ListEntry;
+    PINVALIDATE_DEVICE_RELATION_DATA Data;
+    KIRQL OldIrql;
 
-    IoSynchronousInvalidateDeviceRelations(
+    KeAcquireSpinLock(&IopDeviceRelationsSpinLock, &OldIrql);
-        Data->DeviceObject,
+    while (!IsListEmpty(&IopDeviceRelationsRequestList))
+    {
+        ListEntry = RemoveHeadList(&IopDeviceRelationsRequestList);
+        KeReleaseSpinLock(&IopDeviceRelationsSpinLock, OldIrql);
+        Data = CONTAINING_RECORD(ListEntry,
+                                 INVALIDATE_DEVICE_RELATION_DATA,
+                                 RequestListEntry);
+
+        IoSynchronousInvalidateDeviceRelations(Data->DeviceObject,
                                                Data->Type);
 
         ObDereferenceObject(Data->DeviceObject);
-    IoFreeWorkItem(Data->WorkItem);
         ExFreePool(Data);
+        KeAcquireSpinLock(&IopDeviceRelationsSpinLock, &OldIrql);
+    }
+    IopDeviceRelationsRequestInProgress = FALSE;
+    KeReleaseSpinLock(&IopDeviceRelationsSpinLock, OldIrql);
 }
 
 NTSTATUS
@@ -1024,7 +1043,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
    DPRINT("ParentNode 0x%p PhysicalDeviceObject 0x%p ServiceName %wZ\n",
       ParentNode, PhysicalDeviceObject, ServiceName);
 
-   Node = (PDEVICE_NODE)ExAllocatePool(NonPagedPool, sizeof(DEVICE_NODE));
+   Node = ExAllocatePoolWithTag(NonPagedPool, sizeof(DEVICE_NODE), TAG_IO_DEVNODE);
    if (!Node)
    {
       return STATUS_INSUFFICIENT_RESOURCES;
@@ -1044,7 +1063,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
       FullServiceName.Buffer = ExAllocatePool(PagedPool, FullServiceName.MaximumLength);
       if (!FullServiceName.Buffer)
       {
-          ExFreePool(Node);
+          ExFreePoolWithTag(Node, TAG_IO_DEVNODE);
           return STATUS_INSUFFICIENT_RESOURCES;
       }
 
@@ -1055,7 +1074,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
       if (!NT_SUCCESS(Status))
       {
          DPRINT1("PnpRootCreateDevice() failed with status 0x%08X\n", Status);
-         ExFreePool(Node);
+         ExFreePoolWithTag(Node, TAG_IO_DEVNODE);
          return Status;
       }
 
@@ -1064,7 +1083,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
       if (!NT_SUCCESS(Status))
       {
           ZwClose(InstanceHandle);
-          ExFreePool(Node);
+          ExFreePoolWithTag(Node, TAG_IO_DEVNODE);
           ExFreePool(FullServiceName.Buffer);
           return Status;
       }
@@ -1073,7 +1092,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
       if (!Node->ServiceName.Buffer)
       {
           ZwClose(InstanceHandle);
-          ExFreePool(Node);
+          ExFreePoolWithTag(Node, TAG_IO_DEVNODE);
           ExFreePool(FullServiceName.Buffer);
           return Status;
       }
@@ -1122,7 +1141,7 @@ IopCreateDeviceNode(PDEVICE_NODE ParentNode,
 
       if (!NT_SUCCESS(Status))
       {
-          ExFreePool(Node);
+          ExFreePoolWithTag(Node, TAG_IO_DEVNODE);
           return Status;
       }
 
@@ -1225,7 +1244,8 @@ IopFreeDeviceNode(PDEVICE_NODE DeviceNode)
       ExFreePool(DeviceNode->BootResources);
    }
 
-   ExFreePool(DeviceNode);
+   ((PEXTENDED_DEVOBJ_EXTENSION)DeviceNode->PhysicalDeviceObject->DeviceObjectExtension)->DeviceNode = NULL;
+   ExFreePoolWithTag(DeviceNode, TAG_IO_DEVNODE);
 
    return STATUS_SUCCESS;
 }
@@ -2560,7 +2580,7 @@ IopActionInitChildServices(PDEVICE_NODE DeviceNode,
 
    DPRINT("IopActionInitChildServices(%p, %p)\n", DeviceNode, Context);
 
-   ParentDeviceNode = (PDEVICE_NODE)Context;
+   ParentDeviceNode = Context;
 
    /*
     * We are called for the parent too, but we don't need to do special
@@ -2610,6 +2630,8 @@ IopActionInitChildServices(PDEVICE_NODE DeviceNode,
       PLDR_DATA_TABLE_ENTRY ModuleObject;
       PDRIVER_OBJECT DriverObject;
 
+      KeEnterCriticalRegion();
+      ExAcquireResourceExclusiveLite(&IopDriverLoadResource, TRUE);
       /* Get existing DriverObject pointer (in case the driver has
          already been loaded and initialized) */
       Status = IopGetDriverObject(
@@ -2641,6 +2663,8 @@ IopActionInitChildServices(PDEVICE_NODE DeviceNode,
             if (!BootDrivers) DeviceNode->Problem = CM_PROB_DRIVER_FAILED_LOAD;
          }
       }
+      ExReleaseResourceLite(&IopDriverLoadResource);
+      KeLeaveCriticalRegion();
 
       /* Driver is loaded and initialized at this point */
       if (NT_SUCCESS(Status))
@@ -3545,7 +3569,7 @@ PipAllocateDeviceNode(IN PDEVICE_OBJECT PhysicalDeviceObject)
     PAGED_CODE();
 
     /* Allocate it */
-    DeviceNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(DEVICE_NODE), 'donD');
+    DeviceNode = ExAllocatePoolWithTag(NonPagedPool, sizeof(DEVICE_NODE), TAG_IO_DEVNODE);
     if (!DeviceNode) return DeviceNode;
 
     /* Statistics */
@@ -4664,29 +4688,32 @@ IoInvalidateDeviceRelations(
     IN PDEVICE_OBJECT DeviceObject,
     IN DEVICE_RELATION_TYPE Type)
 {
-    PIO_WORKITEM WorkItem;
     PINVALIDATE_DEVICE_RELATION_DATA Data;
+    KIRQL OldIrql;
 
     Data = ExAllocatePool(NonPagedPool, sizeof(INVALIDATE_DEVICE_RELATION_DATA));
     if (!Data)
         return;
-    WorkItem = IoAllocateWorkItem(DeviceObject);
-    if (!WorkItem)
-    {
-        ExFreePool(Data);
-        return;
-    }
 
     ObReferenceObject(DeviceObject);
     Data->DeviceObject = DeviceObject;
     Data->Type = Type;
-    Data->WorkItem = WorkItem;
 
-    IoQueueWorkItem(
+    KeAcquireSpinLock(&IopDeviceRelationsSpinLock, &OldIrql);
-        WorkItem,
+    InsertTailList(&IopDeviceRelationsRequestList, &Data->RequestListEntry);
-        IopAsynchronousInvalidateDeviceRelations,
+    if (IopDeviceRelationsRequestInProgress)
-        DelayedWorkQueue,
+    {
-        Data);
+        KeReleaseSpinLock(&IopDeviceRelationsSpinLock, OldIrql);
+        return;
+    }
+    IopDeviceRelationsRequestInProgress = TRUE;
+    KeReleaseSpinLock(&IopDeviceRelationsSpinLock, OldIrql);
+
+    ExInitializeWorkItem(&IopDeviceRelationsWorkItem,
+                         IopDeviceRelationsWorker,
+                         NULL);
+    ExQueueWorkItem(&IopDeviceRelationsWorkItem,
+                    DelayedWorkQueue);
 }
 
 /*

win32ss/gdi/dib/dib.c

@@ -47,7 +47,7 @@ DIB_FUNCTIONS DibFunctionsForBitmapFormat[] =
   {
     DIB_16BPP_PutPixel, DIB_16BPP_GetPixel, DIB_16BPP_HLine, DIB_16BPP_VLine,
     DIB_16BPP_BitBlt, DIB_16BPP_BitBltSrcCopy, DIB_XXBPP_StretchBlt,
-    DIB_16BPP_TransparentBlt, DIB_16BPP_ColorFill, DIB_XXBPP_AlphaBlend
+    DIB_16BPP_TransparentBlt, DIB_16BPP_ColorFill, DIB_16BPP_AlphaBlend
   },
   /* BMF_24BPP */
   {

win32ss/gdi/dib/dib.h

@@ -101,6 +101,7 @@ BOOLEAN DIB_16BPP_BitBlt(PBLTINFO);
 BOOLEAN DIB_16BPP_BitBltSrcCopy(PBLTINFO);
 BOOLEAN DIB_16BPP_TransparentBlt(SURFOBJ*,SURFOBJ*,RECTL*,RECTL*,XLATEOBJ*,ULONG);
 BOOLEAN DIB_16BPP_ColorFill(SURFOBJ*, RECTL*, ULONG);
+BOOLEAN DIB_16BPP_AlphaBlend(SURFOBJ*, SURFOBJ*, RECTL*, RECTL*, CLIPOBJ*, XLATEOBJ*, BLENDOBJ*);
 
 VOID DIB_24BPP_PutPixel(SURFOBJ*,LONG,LONG,ULONG);
 ULONG DIB_24BPP_GetPixel(SURFOBJ*,LONG,LONG);

win32ss/gdi/dib/dib16bpp.c

@@ -525,4 +525,135 @@ DIB_16BPP_TransparentBlt(SURFOBJ *DestSurf, SURFOBJ *SourceSurf,
   return TRUE;
 }
 
+typedef union
+{
+  ULONG ul;
+  struct
+  {
+    UCHAR red;
+    UCHAR green;
+    UCHAR blue;
+    UCHAR alpha;
+  } col;
+} NICEPIXEL32;
+
+typedef union
+{
+  USHORT us;
+  struct
+  {
+    USHORT red   :5;
+    USHORT green :6;
+    USHORT blue  :5;
+  } col;
+} NICEPIXEL16;
+
+static __inline UCHAR
+Clamp6(ULONG val)
+{
+   return (val > 63) ? 63 : (UCHAR)val;
+}
+
+static __inline UCHAR
+Clamp5(ULONG val)
+{
+   return (val > 31) ? 31 : (UCHAR)val;
+}
+
+BOOLEAN
+DIB_16BPP_AlphaBlend(SURFOBJ* Dest, SURFOBJ* Source, RECTL* DestRect,
+                     RECTL* SourceRect, CLIPOBJ* ClipRegion,
+                     XLATEOBJ* ColorTranslation, BLENDOBJ* BlendObj)
+{
+  INT DstX, DstY, SrcX, SrcY;
+  BLENDFUNCTION BlendFunc;
+  NICEPIXEL32 SrcPixel32;
+  NICEPIXEL16 DstPixel16;
+  UCHAR Alpha, Alpha6, Alpha5;
+  EXLATEOBJ* pexlo;
+  EXLATEOBJ exloSrcRGB;
+
+  DPRINT("DIB_16BPP_AlphaBlend: srcRect: (%d,%d)-(%d,%d), dstRect: (%d,%d)-(%d,%d)\n",
+    SourceRect->left, SourceRect->top, SourceRect->right, SourceRect->bottom,
+    DestRect->left, DestRect->top, DestRect->right, DestRect->bottom);
+
+  BlendFunc = BlendObj->BlendFunction;
+  if (BlendFunc.BlendOp != AC_SRC_OVER)
+  {
+    DPRINT1("BlendOp != AC_SRC_OVER\n");
+    return FALSE;
+  }
+  if (BlendFunc.BlendFlags != 0)
+  {
+    DPRINT1("BlendFlags != 0\n");
+    return FALSE;
+  }
+  if ((BlendFunc.AlphaFormat & ~AC_SRC_ALPHA) != 0)
+  {
+    DPRINT1("Unsupported AlphaFormat (0x%x)\n", BlendFunc.AlphaFormat);
+    return FALSE;
+  }
+  if ((BlendFunc.AlphaFormat & AC_SRC_ALPHA) != 0 &&
+          (BitsPerFormat(Source->iBitmapFormat) != 32))
+  {
+    DPRINT1("Source bitmap must be 32bpp when AC_SRC_ALPHA is set\n");
+    return FALSE;
+  }
+
+  if (!ColorTranslation)
+  {
+    DPRINT1("ColorTranslation must not be NULL!\n");
+    return FALSE;
+  }
+
+  pexlo = CONTAINING_RECORD(ColorTranslation, EXLATEOBJ, xlo);
+  EXLATEOBJ_vInitialize(&exloSrcRGB, pexlo->ppalSrc, &gpalRGB, 0, 0, 0);
+
+  SrcY = SourceRect->top;
+  DstY = DestRect->top;
+  while ( DstY < DestRect->bottom )
+  {
+    SrcX = SourceRect->left;
+    DstX = DestRect->left;
+    while(DstX < DestRect->right)
+    {
+      SrcPixel32.ul = DIB_GetSource(Source, SrcX, SrcY, &exloSrcRGB.xlo);
+      SrcPixel32.col.red = (SrcPixel32.col.red * BlendFunc.SourceConstantAlpha) / 255;
+      SrcPixel32.col.green = (SrcPixel32.col.green * BlendFunc.SourceConstantAlpha) / 255;
+      SrcPixel32.col.blue = (SrcPixel32.col.blue * BlendFunc.SourceConstantAlpha) / 255;
+
+      Alpha = ((BlendFunc.AlphaFormat & AC_SRC_ALPHA) != 0) ?
+           (SrcPixel32.col.alpha * BlendFunc.SourceConstantAlpha) / 255 :
+           BlendFunc.SourceConstantAlpha;
+
+      Alpha6 = Alpha >> 2;
+      Alpha5 = Alpha >> 3;
+
+      DstPixel16.us = DIB_16BPP_GetPixel(Dest, DstX, DstY) & 0xFFFF;
+      /* Perform bit loss */
+      SrcPixel32.col.red >>= 3;
+      SrcPixel32.col.green >>= 2;
+      SrcPixel32.col.blue >>= 3;
+
+      /* Do the blend in the right bit depth */
+      DstPixel16.col.red = Clamp5((DstPixel16.col.red * (31 - Alpha5)) / 31 + SrcPixel32.col.red);
+      DstPixel16.col.green = Clamp6((DstPixel16.col.green * (63 - Alpha6)) / 63 + SrcPixel32.col.green);
+      DstPixel16.col.blue = Clamp5((DstPixel16.col.blue * (31 - Alpha5)) / 31 + SrcPixel32.col.blue);
+
+      DIB_16BPP_PutPixel(Dest, DstX, DstY, DstPixel16.us);
+
+      DstX++;
+      SrcX = SourceRect->left + ((DstX-DestRect->left)*(SourceRect->right - SourceRect->left))
+                                            /(DestRect->right-DestRect->left);
+    }
+    DstY++;
+    SrcY = SourceRect->top + ((DstY-DestRect->top)*(SourceRect->bottom - SourceRect->top))
+                                            /(DestRect->bottom-DestRect->top);
+  }
+
+  EXLATEOBJ_vCleanup(&exloSrcRGB);
+
+  return TRUE;
+}
+
 /* EOF */

win32ss/gdi/ntgdi/bitmaps.c

@@ -249,6 +249,7 @@ IntCreateCompatibleBitmap(
         /* Set flags */
         psurf->flags = API_BITMAP;
         psurf->hdc = NULL; // FIXME:
+        psurf->SurfObj.hdev = (HDEV)Dc->ppdev;
         SURFACE_ShareUnlockSurface(psurf);
     }
     else
@@ -277,6 +278,7 @@ IntCreateCompatibleBitmap(
             /* Set flags */
             psurfBmp->flags = API_BITMAP;
             psurfBmp->hdc = NULL; // FIXME:
+            psurf->SurfObj.hdev = (HDEV)Dc->ppdev;
             SURFACE_ShareUnlockSurface(psurfBmp);
         }
         else if (Count == sizeof(DIBSECTION))

win32ss/gdi/ntgdi/dcobjs.c

@@ -330,6 +330,10 @@ DC_bIsBitmapCompatible(PDC pdc, PSURFACE psurf)
     /* DIB sections are always compatible */
     if (psurf->hSecure != NULL) return TRUE;
 
+    /* See if this is the same PDEV */
+    if (psurf->SurfObj.hdev == (HDEV)pdc->ppdev)
+        return TRUE;
+
     /* Get the bit depth of the bitmap */
     cBitsPixel = gajBitsPerFormat[psurf->SurfObj.iBitmapFormat];
 

win32ss/user/ntuser/hook.c

@@ -1294,12 +1294,14 @@ IntUnhookWindowsHook(int HookId, HOOKPROC pfnFilterProc)
        {
           Hook = CONTAINING_RECORD(pElement, HOOK, Chain);
 
+          /* Get the next element now, we might free the hook in what follows */
+          pElement = Hook->Chain.Flink;
+
           if (Hook->Proc == pfnFilterProc)
           {
              if (Hook->head.pti == pti)
              {
                 IntRemoveHook(Hook);
-                UserDereferenceObject(Hook);
                 return TRUE;
              }
              else
@@ -1308,8 +1310,6 @@ IntUnhookWindowsHook(int HookId, HOOKPROC pfnFilterProc)
                 return FALSE;
              }
           }
-
-          pElement = Hook->Chain.Flink;
        }
     }
     return FALSE;

win32ss/user/user32/windows/message.c

@@ -2648,6 +2648,7 @@ SendMessageTimeoutA(
 
   dsm.uFlags = fuFlags;
   dsm.uTimeout = uTimeout;
+  dsm.Result = 0;
 
   AnsiMsg.hwnd = hWnd;
   AnsiMsg.message = Msg;
@@ -2709,6 +2710,7 @@ SendMessageTimeoutW(
 
   dsm.uFlags = fuFlags;
   dsm.uTimeout = uTimeout;
+  dsm.Result = 0;
 
   Result = NtUserMessageCall( hWnd,
                               Msg,