/*++

    Copyright (c) Microsoft Corporation.  All rights reserved.

Rule Name:

    ForwardedAtBadIrqlFsdAsync

Domain:

    wdm

Rule ID:

    Not Applicable

Description:

    The ForwardedAtBadIrql rule specifies that the driver call
    IoCallDriver and PoCallDriver at IRQL<DISPATCH_LEVEL unless
    the IRP major function code being forwarded is one of the
    following:
		IRP_MJ_POWER 
		IRP_MJ_READ 
		IRP_MJ_WRITE 
		IRP_MJ_DEVICE_CONTROL 
		IRP_MJ_INTERNAL_DEVICE_CONTROL

Help Link:

    https://go.microsoft.com/fwlink/?LinkId=507258

--*/





#include "slic_base.h"
state
{
}
watch IoBuildAsynchronousFsdRequest.exit.$return;

IoBuildAsynchronousFsdRequest.exit[guard $return]
{
    if($return==NULL)
    {
        halt;
    }
    else if(($1==IRP_MJ_READ)||($1==IRP_MJ_WRITE))
    {
        halt;
    }
}


[IoCallDriver,PoCallDriver].entry[guard $2]
{
    if ( sdv_irql_current >= DISPATCH_LEVEL ) 
    {
         if ( sdv_IoBuildAsynchronousFsdRequest_harnessStackLocation_next.MajorFunction != IRP_MJ_POWER 
              && sdv_IoBuildAsynchronousFsdRequest_harnessStackLocation_next.MajorFunction != IRP_MJ_READ 
              && sdv_IoBuildAsynchronousFsdRequest_harnessStackLocation_next.MajorFunction != IRP_MJ_WRITE 
              && sdv_IoBuildAsynchronousFsdRequest_harnessStackLocation_next.MajorFunction != IRP_MJ_DEVICE_CONTROL 
              && sdv_IoBuildAsynchronousFsdRequest_harnessStackLocation_next.MajorFunction != IRP_MJ_INTERNAL_DEVICE_CONTROL) 
              {
                abort "The driver is forwarding an IRP at an IRQL that is illegal for the IRP's major code";
              }
              else
              {
                  halt;
              }
     }
     else
     {
         halt;
     }
}
