/*++

    Copyright (c) Microsoft Corporation.  All rights reserved.

Rule Name:

    PowerIrpDDis

Domain:

    wdm

Rule ID:

    Not Applicable

Description:

    When a driver is processing a system or a device IRP_MJ_POWER with IRP_MN_SET_POWER it should not call DDIs that can only be call at PASSIVE_LEVEL.

Help Link:

    https://go.microsoft.com/fwlink/?LinkId=507299

--*/

#include "slic_base.h"

state
{
}




[EtwRegister,
EtwUnregister,
ExRaiseDatatypeMisalignment,
ExRaiseAccessViolation,
ExIsProcessorFeaturePresent,
ExUuidCreate,
FsRtlCopyRead,
FsRtlCopyWrite,
FsRtlMdlRead,
FsRtlMdlReadComplete,
FsRtlMdlReadCompleteDev,
FsRtlMdlWriteCompleteDev,
FsRtlAcquireFileExclusive,
FsRtlGetFileSize,
FsRtlBalanceReads,
FsRtlNotifyFullChangeDirectory,
FsRtlNotifyFilterChangeDirectory,
FsRtlNotifyFilterReportChange,
FsRtlNotifyFullReportChange,
FsRtlDissectName,
FsRtlDoesNameContainWildCards,
FsRtlAreNamesEqual,
FsRtlIsNameInExpression,
FsRtlRegisterUncProviderEx,
FsRtlRegisterUncProvider,
FsRtlDeregisterUncProvider,
FsRtlCancellableWaitForMultipleObjects,
FsRtlValidateReparsePointBuffer,
FsRtlRemoveDotsFromPath,
FsRtlChangeBackingFileObject,
HalGetInterruptVector,
HalGetAdapter,
IoBuildDeviceIoControlRequest,
IoBuildSynchronousFsdRequest,
IoCheckShareAccess,
IoConnectInterrupt,
IoCreateController,
IoIsWdmVersionAvailable,
IoCreateFile,
IoCreateSymbolicLink,
IoCreateSynchronizationEvent,
IoCreateUnprotectedSymbolicLink,
IoDeleteController,
IoDeleteSymbolicLink,
IoDetachDevice,
IoDisconnectInterrupt,
IoGetConfigurationInformation,
IoGetDeviceToVerify,
IoGetDeviceObjectPointer,
IoGetDmaAdapter,
IoGetFileObjectGenericMapping,
IoInitializeTimer,
IoRegisterBootDriverReinitialization,
IoRegisterDriverReinitialization,
IoRegisterShutdownNotification,
IoRegisterLastChanceShutdownNotification,
IoRemoveShareAccess,
IoInitializeRemoveLockEx,
IoReleaseRemoveLockAndWaitEx,
IoUnregisterShutdownNotification,
IoUpdateShareAccess,
IoWMIRegistrationControl,
IoWMIAllocateInstanceIds,
HalExamineMBR,
IoReadPartitionTable,
IoSetPartitionInformation,
IoWritePartitionTable,
IoReadPartitionTableEx,
IoWritePartitionTableEx,
IoSetPartitionInformationEx,
KeRemoveQueue,
KeRemoveQueue,
KeInitializeSemaphore,
KeDelayExecutionThread,
KeQueryPriorityThread,
KeQueryRuntimeThread,
KeSetSystemAffinityThread,
KeRevertToUserAffinityThreadEx,
KeSetSystemGroupAffinityThread,
MmOutPageKernelStack,
MmGetSystemRoutineAddress,
MmAddPhysicalMemory,
MmRemovePhysicalMemory,
MmGetPhysicalMemoryRanges,
MmCreateMirror,
MmPrefetchPages,
IoReportDetectedDevice,
IoGetDeviceProperty,
IoOpenDeviceRegistryKey,
IoRegisterDeviceInterface,
IoOpenDeviceInterfaceRegistryKey,
IoSetDeviceInterfaceState,
IoGetDeviceInterfaces,
IoGetDeviceInterfaceAlias,
IoRegisterPlugPlayNotification,
IoUnregisterPlugPlayNotification,
IoUnregisterPlugPlayNotificationEx,
IoReportTargetDeviceChange,
IoSetDevicePropertyData,
IoGetDevicePropertyData,
IoGetDeviceNumaNode,
IoReplacePartitionUnit,
PsTerminateSystemThread,
PsSetCreateProcessNotifyRoutine,
PsSetCreateProcessNotifyRoutineEx,
PsSetCreateThreadNotifyRoutine,
PsSetLoadImageNotifyRoutine,
PsRemoveLoadImageNotifyRoutine,
PsAssignImpersonationToken,
PsReferencePrimaryToken,
PsDereferencePrimaryToken,
PsDereferenceImpersonationToken,
PsImpersonateClient,
PsDisableImpersonation,
PsRestoreImpersonation,
PsRevertToSelf,
PsGetVersion,
SeAssignSecurity,
SeDeassignSecurity,
SeAccessCheck,
SeValidSecurityDescriptor,
SeSinglePrivilegeCheck,
ZwCreateFile,
ZwOpenFile,
ZwLoadDriver,
ZwUnloadDriver,
ZwQueryInformationFile,
ZwSetInformationFile,
ZwReadFile,
ZwWriteFile,
ZwClose,
ZwCreateDirectoryObject,
ZwMakeTemporaryObject,
ZwOpenSection,
ZwMapViewOfSection,
ZwUnmapViewOfSection,
ZwCreateKey,
ZwCreateKeyTransacted,
ZwOpenKey,
ZwOpenKeyEx,
ZwOpenKeyTransacted,
ZwOpenKeyTransactedEx,
ZwDeleteKey,
ZwDeleteValueKey,
ZwEnumerateKey,
ZwEnumerateValueKey,
ZwQueryKey,
ZwQueryValueKey,
ZwRenameKey,
ZwSetValueKey,
ZwOpenSymbolicLinkObject,
ZwQuerySymbolicLinkObject,
ZwCreateTransactionManager,
ZwOpenTransactionManager,
ZwRecoverTransactionManager,
ZwQueryInformationTransactionManager,
ZwEnumerateTransactionObject,
ZwCreateTransaction,
ZwOpenTransaction,
ZwQueryInformationTransaction,
ZwSetInformationTransaction,
ZwCommitTransaction,
ZwRollbackTransaction,
ZwCreateResourceManager,
ZwOpenResourceManager,
ZwGetNotificationResourceManager,
ZwQueryInformationResourceManager,
ZwSetInformationResourceManager,
ZwCreateEnlistment,
ZwOpenEnlistment,
ZwQueryInformationEnlistment,
ZwSetInformationEnlistment,
ZwRecoverEnlistment,
ZwPrePrepareEnlistment,
ZwPrepareEnlistment,
ZwCommitEnlistment,
ZwRollbackEnlistment,
ZwPrePrepareComplete,
ZwPrepareComplete,
ZwCommitComplete,
ZwReadOnlyEnlistment,
ZwRollbackComplete,
ZwOpenEvent,
ZwQueryFullAttributesFile,
ZwSetInformationThread,
ZwCreateTimer,
ZwOpenTimer,
ZwCancelTimer,
ZwSetTimer,
ZwSetTimerEx,
ZwQueryVolumeInformationFile,
ZwDeviceIoControlFile,
ZwDisplayString,
ZwPowerInformation,
ZwQueryObject,
ZwNotifyChangeKey,
ZwCreateEvent,
ZwDeleteFile,
ZwDeviceIoControlFile,
ZwQueryDirectoryFile,
ZwQueryVolumeInformationFile,
ZwSetVolumeInformationFile,
ZwFsControlFile,
ZwDuplicateObject,
ZwOpenDirectoryObject,
ZwAllocateVirtualMemory,
ZwFreeVirtualMemory,
ZwOpenProcessTokenEx,
ZwOpenThreadTokenEx,
ZwQueryInformationToken,
ZwSetInformationToken,
ZwSetSecurityObject,
ZwQuerySecurityObject,
ZwLockFile,
ZwUnlockFile,
ZwQueryQuotaInformationFile,
ZwSetQuotaInformationFile,
ZwFlushBuffersFile,
ZwQueryEaFile,
ZwSetEaFile,
ZwDuplicateToken,
ZwAllocateLocallyUniqueId,
ZwTerminateProcess,
ZwOpenProcess,
ZwSetInformationToken].entry 
{ 
	abort "One should not call Paged routine while processing a POWER Irp.";
}


[PshedRegisterPlugin,
ZwNotifyChangeMultipleKeys,
ZwQueryMultipleValueKey,
ZwRollforwardTransactionManager,
ZwSetInformationKey,
ZwSetInformationTransactionManager,
ZwSinglePhaseReject]@SDV.entry 
{
	abort "One should not call Paged routine while processing a POWER Irp."; 
}


[fun_IRP_MJ_POWER].exit
{ 
	if($2->Tail.Overlay.CurrentStackLocation->MajorFunction==IRP_MJ_POWER) 
	{
		halt; 
	}
} 
