support/km/fxtelemetrykm.cpp

/*++

Copyright (c) Microsoft Corporation

Module Name:

    FxTelemetryKm.cpp

Abstract:

    This module implements a telemetry methods.

Author:


Environment:

    Kernel mode only

Revision History:

Notes:

--*/

#include "fxsupportpch.hpp"
#include "fxldr.h"
#include <ntstrsafe.h>
#include <winmeta.h>
#include <telemetry\microsofttelemetry.h>

extern "C" {
#if defined(EVENT_TRACING)
#include "FxTelemetryKm.tmh"
#endif
}

/* ec044b58-3d13-3d13-936f-7b67dfb3e */
TRACELOGGING_DEFINE_PROVIDER(g_TelemetryProvider,
    KMDF_FX_TRACE_LOGGING_PROVIDER_NAME,
    (0xec044b58, 0x3d13, 0x4880, 0x93, 0x6f, 0x7b, 0x67, 0xdf, 0xb3, 0xe0, 0x56),
    TraceLoggingOptionMicrosoftTelemetry());

VOID
AllocAndInitializeTelemetryContext(
    _In_ PFX_TELEMETRY_CONTEXT* TelemetryContext
    )
{
    PFX_TELEMETRY_CONTEXT context = NULL;
    NTSTATUS status;

    context = (PFX_TELEMETRY_CONTEXT)MxMemory::MxAllocatePoolWithTag(
                                                    NonPagedPool,
                                                    sizeof(FX_TELEMETRY_CONTEXT),
                                                    FX_TAG);
    if (NULL == context) {
        goto exit;
    }

    status = ExUuidCreate(&(context->DriverSessionGUID));
    if (!NT_SUCCESS(status)) {
        MxMemory::MxFreePool(context);
        context = NULL;
        goto exit;
    }

    context->DoOnceFlagsBitmap = 0;

exit:
    *TelemetryContext = context;
}

VOID
RegisterTelemetryProvider(
    VOID
    )
{
    TraceLoggingRegister(g_TelemetryProvider);
}

VOID
UnregisterTelemetryProvider(
    VOID
    )
{
    TraceLoggingUnregister(g_TelemetryProvider);
}

VOID
LogDeviceStartTelemetryEvent(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals,
    _In_opt_ FxDevice* Fdo
    )
{
    //
    // See if telemetry registered and all the criteria to log is met.
    if (IsLoggingEnabledAndNeeded(DriverGlobals) == FALSE) {
        return;
    }

    //
    // Log driver info stream
    //
    LogDriverInfoStream(DriverGlobals, Fdo);
}

BOOLEAN
IsLoggingEnabledAndNeeded(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals
    )
{
    LARGE_INTEGER lastLoggedTime;
    LARGE_INTEGER currentTime;
    LONGLONG delta;

    // If provider is not enabled exit.
    if (FALSE == FX_TELEMETRY_ENABLED(g_TelemetryProvider, DriverGlobals)) {
        return FALSE;
    }

    ASSERT(DriverGlobals->TelemetryContext);

    //
    // If we already fired an event during PnP start we are done. This avoids
    // repeatedly firing events during PnP rebalance.
    //
    if (InterlockedBitTestAndSet(
            &DriverGlobals->TelemetryContext->DoOnceFlagsBitmap,
            DeviceStartEventBit) != 0) {
        return FALSE;
    }

    //
    // log only if it has been MIN_HOURS_BEFORE_NEXT_LOG time since last log.
    // We don't log every time driver loads to avoid sending too much data
    // too many times in  case of a buggy driver going through load/unload cycle
    // or when a device is plugged in two many times.
    //
    lastLoggedTime.QuadPart = 0;
    RegistryReadLastLoggedTime(DriverGlobals, &lastLoggedTime);

    if (lastLoggedTime.QuadPart == 0) {
        //
        // driver is loading for first time ater install so need to log
        // event
        //
        return TRUE;
    }

    Mx::MxQuerySystemTime(&currentTime);

    delta = (currentTime.QuadPart - lastLoggedTime.QuadPart);

    DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_VERBOSE, TRACINGDRIVER,
        "lastlogged %I64x, current %I64x, delta %I64x",
        lastLoggedTime.QuadPart, currentTime.QuadPart, delta);

    //
    // KeQuerySystemTime returns time in 100-ns. We convert MIN_HOURS_BEFORE_NEXT_LOG
    // to 100-nano sec unit and then compare.
    //
    if (delta < WDF_ABS_TIMEOUT_IN_SEC(MIN_HOURS_BEFORE_NEXT_LOG * 60 * 60)) {
        return FALSE;
    }

    return TRUE;
}

VOID
LogDriverInfoStream(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals,
    _In_opt_ FxDevice* Fdo
    )
{
    FxTelemetryDriverInfo driverInfo = {0};
    FxAutoString hardwareIDs, setupClass, busEnum, manufacturer;

    //
    // Log driver and device info
    //
    GetDriverInfo(DriverGlobals, Fdo, &driverInfo);

    if (Fdo != NULL) {
        //
        // Get Setup class
        //
        FxGetDevicePropertyString(Fdo,
                                  DevicePropertyClassName,
                                  &setupClass.m_UnicodeString);
        //
        // Get Bus enumerator
        //
        FxGetDevicePropertyString(Fdo,
                                  DevicePropertyEnumeratorName,
                                  &busEnum.m_UnicodeString);
        //
        // Get hardware id multi-string
        //
        FxGetDevicePropertyString(Fdo,
                                  DevicePropertyHardwareID,
                                  &hardwareIDs.m_UnicodeString);

        GetFirstHardwareId(&hardwareIDs.m_UnicodeString);

        //
        // Get manufacturer
        //
        FxGetDevicePropertyString(Fdo,
                                  DevicePropertyManufacturer,
                                  &manufacturer.m_UnicodeString);
    }

    KMDF_CENSUS_EVT_WRITE_DEVICE_START(g_TelemetryProvider,
        DriverGlobals,
        driverInfo,
        setupClass,
        busEnum,
        hardwareIDs,
        manufacturer);

    //
    // write current time to registry
    //
    RegistryWriteCurrentTime(DriverGlobals);
}

VOID
GetFirstHardwareId(
    _Inout_ PUNICODE_STRING HardwareIds
    )
/*++

    Routine Description:

        This routine returns the first hardware ID present in the multi-string.
        If the first string is longer than max allowed by Telemetry, a null value is
        returned instead of retruning a partial ID.

    Arguments:

        HardwareIds - a multi-string terminated by two unicode_nulls.

--*/

{
    PWCHAR curr;
    USHORT lengthCch;

    ASSERT(HardwareIds != NULL);

    curr = (PWCHAR) HardwareIds->Buffer;
    lengthCch = (HardwareIds->Length)/sizeof(WCHAR);

    //
    // if the caller supplied NULL buffer, then nothing to do.
    //
    if (curr == NULL) {
        RtlInitUnicodeString(HardwareIds, NULL);
        return;
    }

    //
    // if the first element is NULL then update the length
    //
    if (*curr == UNICODE_NULL) {
        HardwareIds->Length = 0;
        HardwareIds->MaximumLength = HardwareIds->Length + sizeof(UNICODE_NULL);
        return;
    }

    for (int i = 0; i < lengthCch; i++, curr++) {

        if (*curr == UNICODE_NULL) {
            //
            // We found the first string. Update size. We only want to keep the
            // first string.
            //
            HardwareIds->Length = (USHORT)(i * sizeof(WCHAR));
            HardwareIds->MaximumLength = HardwareIds->Length + sizeof(UNICODE_NULL);
            return;
        }
    }
}

VOID
GetDriverInfo(
    _In_ PFX_DRIVER_GLOBALS Globals,
    _In_opt_ FxDevice* Fdo,
    _Out_ FxTelemetryDriverInfo* DriverInfo
    )
{
    FxPkgPnp* pnpPkg;
    USHORT devInfo = 0;

    DriverInfo->bitmap.IsVerifierOn = Globals->FxVerifierOn;
    DriverInfo->bitmap.IsEnhancedVerifierOn = FLAG_TO_BOOL(Globals->FxEnhancedVerifierOptions, FxEnhancedVerifierFunctionTableHookMask);

    if (Fdo == NULL) {
        //
        // this is for non-pnp or noDispatchOverride.
        //
        DriverInfo->bitmap.IsNonPnpDriver = FLAG_TO_BOOL(Globals->Public.DriverFlags, WdfDriverInitNonPnpDriver);
        DriverInfo->bitmap.IsNoDispatchOverride = FLAG_TO_BOOL(Globals->Public.DriverFlags, WdfDriverInitNoDispatchOverride);
    }
    else {
        pnpPkg = Fdo->m_PkgPnp;
        devInfo = Fdo->GetDeviceTelemetryInfoFlags();

        DriverInfo->bitmap.IsFilter = Fdo->GetFdoPkg()->IsFilter();
        DriverInfo->bitmap.IsUsingRemoveLockOption = Fdo->IsRemoveLockEnabledForIo();
        DriverInfo->bitmap.IsUsingNonDefaultHardwareReleaseOrder = pnpPkg->IsDefaultReleaseHardwareOrder();
        DriverInfo->bitmap.IsPowerPolicyOwner = pnpPkg->IsPowerPolicyOwner();
        DriverInfo->bitmap.IsS0IdleWakeFromS0Enabled =  pnpPkg->IsS0IdleWakeFromS0Enabled();
        DriverInfo->bitmap.IsS0IdleUsbSSEnabled = pnpPkg->IsS0IdleUsbSSEnabled();
        DriverInfo->bitmap.IsS0IdleSystemManaged = pnpPkg->IsS0IdleSystemManaged();
        DriverInfo->bitmap.IsSxWakeEnabled = pnpPkg->IsSxWakeEnabled();
        DriverInfo->bitmap.IsUsingLevelTriggeredLineInterrupt = IsDeviceInfoFlagSet(devInfo, DeviceInfoLineBasedLevelTriggeredInterrupt);
        DriverInfo->bitmap.IsUsingEdgeTriggeredLineInterrupt = IsDeviceInfoFlagSet(devInfo, DeviceInfoLineBasedEdgeTriggeredInterrupt);
        DriverInfo->bitmap.IsUsingMsiXOrSingleMsi22Interrupt = IsDeviceInfoFlagSet(devInfo, DeviceInfoMsiXOrSingleMsi22Interrupt);
        DriverInfo->bitmap.IsUsingMsi22MultiMessageInterrupt = IsDeviceInfoFlagSet(devInfo, DeviceInfoMsi22MultiMessageInterrupt);
        DriverInfo->bitmap.IsUsingMultipleInterrupt = pnpPkg->HasMultipleInterrupts();
        DriverInfo->bitmap.IsUsingPassiveLevelInterrupt = IsDeviceInfoFlagSet(devInfo, DeviceInfoPassiveLevelInterrupt);
        DriverInfo->bitmap.IsUsingBusMasterDma = IsDeviceInfoFlagSet(devInfo, DeviceInfoDmaBusMaster);
        DriverInfo->bitmap.IsUsingSystemDma = IsDeviceInfoFlagSet(devInfo, DeviceInfoDmaSystem);
        DriverInfo->bitmap.IsUsingSystemDmaDuplex = IsDeviceInfoFlagSet(devInfo, DeviceInfoDmaSystemDuplex);
        DriverInfo->bitmap.IsUsingStaticBusEnumration = IsDeviceInfoFlagSet(devInfo, DeviceInfoHasStaticChildren);
        DriverInfo->bitmap.IsUsingDynamicBusEnumeration = IsDeviceInfoFlagSet(devInfo, DeviceInfoHasDynamicChildren);
    }
}

VOID
RegistryReadLastLoggedTime(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals,
    _Out_ PLARGE_INTEGER LastLoggedTime
    )
{
    FxAutoRegKey hKey, hWdf;
    DECLARE_CONST_UNICODE_STRING(parametersPath, L"Parameters\\Wdf");
    DECLARE_CONST_UNICODE_STRING(valueName, WDF_LAST_TELEMETRY_LOG_TIME_VALUE);
    LARGE_INTEGER value;
    NTSTATUS status;

    ASSERT(LastLoggedTime != NULL);
    LastLoggedTime->QuadPart = 0;

    status = FxRegKey::_OpenKey(NULL,
                                DriverGlobals->Driver->GetRegistryPathUnicodeString(),
                                &hWdf.m_Key,
                                KEY_READ);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to open driver's service key, status %!STATUS!", status);
        return;
    }

    status = FxRegKey::_OpenKey(hWdf.m_Key,
                                &parametersPath,
                                &hKey.m_Key,
                                KEY_READ);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to open driver's service parameters key, status %!STATUS!",
            status);
        return;
    }

    value.QuadPart = 0;
    status = FxRegKey::_QueryQuadWord(
        hKey.m_Key, &valueName, &value);

    //
    // Set value only on success.
    //
    if (NT_SUCCESS(status)) {
        LastLoggedTime->QuadPart = value.QuadPart;
    }
}

VOID
RegistryWriteCurrentTime(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals
    )
{
    FxAutoRegKey hDriver, hParameters, hWdf;
    DECLARE_CONST_UNICODE_STRING(parametersPart, L"Parameters");
    DECLARE_CONST_UNICODE_STRING(wdfPart, L"Wdf");
    LARGE_INTEGER currentTime;

    //
    // Not defined with the macro because ZwSetValue doesn't use
    // PCUNICODE_STRING
    //
    UNICODE_STRING wdfTimeOfLastTelemetryLog;
    NTSTATUS status;

    RtlInitUnicodeString(&wdfTimeOfLastTelemetryLog, WDF_LAST_TELEMETRY_LOG_TIME_VALUE);

    status = FxRegKey::_OpenKey(NULL,
                                DriverGlobals->Driver->GetRegistryPathUnicodeString(),
                                &hDriver.m_Key,
                                KEY_WRITE | KEY_READ
                                );
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to open driver's service key, status %!STATUS!", status);
        return;
    }
    //
    //  Key creation, unlike user mode, must happen one level at a time, since
    //  create will also open take both steps instead of trying open first
    //
    status = FxRegKey::_Create(hDriver.m_Key,
                               &parametersPart,
                               &hParameters.m_Key,
                               KEY_WRITE | KEY_READ
                               );
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to write Parameters key, status %!STATUS!", status);
        return;
    }

    status = FxRegKey::_Create(hParameters.m_Key,
                               &wdfPart,
                               &hWdf.m_Key,
                               KEY_WRITE | KEY_READ
                               );
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to write Parameters key, status %!STATUS!", status);
        return;
    }

    //
    //  Using ZwSetValueKey here to avoid having to change the implementation
    //  in FxRegKey of SetValue to a static / thiscall pair
    //
    currentTime.QuadPart = 0;
    Mx::MxQuerySystemTime(&currentTime);

    status = Mx::MxSetValueKey(hWdf.m_Key,
                           &wdfTimeOfLastTelemetryLog,
                           0,
                           REG_QWORD,
                           &currentTime.QuadPart,
                           sizeof(currentTime)
                           );

    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Failed to record current time for Telemetry log, status %!STATUS!",
            status);
    }
}

VOID
FxGetDevicePropertyString(
    _In_ FxDevice* Fdo,
    _In_ DEVICE_REGISTRY_PROPERTY  DeviceProperty,
    _Out_ PUNICODE_STRING PropertyString
    )
{
    MdDeviceObject pdo;
    NTSTATUS status;
    PFX_DRIVER_GLOBALS pFxDriverGlobals = Fdo->GetDriverGlobals();
    ULONG length = 0;
    PVOID buffer = NULL;

    ASSERT(PropertyString != NULL);
    RtlZeroMemory(PropertyString, sizeof(UNICODE_STRING));

    pdo = Fdo->GetSafePhysicalDevice();
    if (pdo  == NULL) {
        status = STATUS_INVALID_DEVICE_REQUEST;
        DoTraceLevelMessage(pFxDriverGlobals, TRACE_LEVEL_ERROR, TRACINGDEVICE,
                            "Could not get PDO from FDO WDFDEVICE 0x%p, %!STATUS!",
                            Fdo->GetHandle(), status);
        return;
    }

    status = FxDevice::_GetDeviceProperty(pdo, DeviceProperty, 0, NULL, &length);
    if (status != STATUS_BUFFER_TOO_SMALL) {
        DoTraceLevelMessage(pFxDriverGlobals, TRACE_LEVEL_ERROR, TRACINGDEVICE,
                            "Could not retrieve property %d length %d, %!STATUS!",
                            DeviceProperty, length, status);
        return;
    }

    buffer = FxPoolAllocate(pFxDriverGlobals, PagedPool, length);
    if (buffer == NULL) {
        status = STATUS_INSUFFICIENT_RESOURCES;
        DoTraceLevelMessage(pFxDriverGlobals, TRACE_LEVEL_ERROR, TRACINGDEVICE,
                "Could not allocate memory for property %d length %d, %!STATUS!",
                DeviceProperty, length, status);
        return;
    }

    status = FxDevice::_GetDeviceProperty(pdo, DeviceProperty, length, buffer, &length);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(pFxDriverGlobals, TRACE_LEVEL_ERROR, TRACINGDEVICE,
                            "Could not query for full buffer, size %d, for "
                            "property %d, %!STATUS!",
                            length, DeviceProperty, status);
        FxPoolFree(buffer);
        return;
    }

    PropertyString->Buffer = (PWCH)buffer;
    PropertyString->Length = (USHORT) length - sizeof(UNICODE_NULL);
    PropertyString->MaximumLength = (USHORT) length;

    //
    // ensure it's null terminated
    //
    PropertyString->Buffer[PropertyString->Length/sizeof(WCHAR)] = UNICODE_NULL;
}

_Must_inspect_result_
NTSTATUS
GetImageName(
    _In_ PFX_DRIVER_GLOBALS DriverGlobals,
    _Out_ PUNICODE_STRING ImageName
    )
/*++

Routine Description:
    Retrieve the ImageName value from the named Service registry key.

    Caller is responsible for freeing the buffer allocated in ImageName::Buffer.

Arguments:
    DriverGlobals - pointer to FX_DRIVER_GLOBALS

    ImageeName - Pointer to a UNICODE_STRING which will receive the image name
        upon a return value of NT_SUCCESS()

Return Value:
    NTSTATUS

--*/
{
    NTSTATUS status;
    FxAutoRegKey hKey;
    DECLARE_CONST_UNICODE_STRING(valueName, L"ImagePath");
    UNICODE_STRING imagePath = {0};
    UNICODE_STRING imageName = {0};
    PKEY_VALUE_PARTIAL_INFORMATION value = NULL;
    USHORT size;

    ASSERT(ImageName != NULL);
    RtlZeroMemory(ImageName, sizeof(UNICODE_STRING));

    //
    // Open driver's Service base key
    //
    status = FxRegKey::_OpenKey(NULL,
                                DriverGlobals->Driver->GetRegistryPathUnicodeString(),
                                &hKey.m_Key,
                                KEY_READ);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Unable to open driver's service key, status %!STATUS!", status);
        return status;
    }

    status = QueryAndAllocString(hKey.m_Key,
                                DriverGlobals,
                                &valueName,
                                &value);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "Failed to get Image name from service key, status %!STATUS!",
            status);
        return status;
    }

    BuildStringFromPartialInfo(value, &imagePath);

    //
    // Now read the "ImagePath" and extract just the driver filename as a new
    // unicode string.
    //
    GetNameFromPath(&imagePath, &imageName);

    if (imageName.Length == 0x0) {
        status = STATUS_INVALID_PARAMETER;
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "ERROR: GetNameFromPath could not find a name, status 0x%x\n",
                 status);
        goto cleanUp;
    }

    //
    // Check for interger overflow for length before we allocate memory
    // size = path->Length + sizeof(UNICODE_NULL);
    // len is used below to compute the string size including the NULL, so
    // compute len to include the terminating NULL.
    //
    status = RtlUShortAdd(imageName.Length, sizeof(UNICODE_NULL), &size);
    if (!NT_SUCCESS(status)) {
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "ERROR: size computation failed with Status 0x%x\n", status);
        goto cleanUp;
    }

    //
    // allocate a buffer to hold Unicode string + null char.
    //
    ImageName->Buffer = (PWCH) FxPoolAllocate(DriverGlobals, PagedPool, size);

    if (ImageName->Buffer == NULL) {
        status = STATUS_INSUFFICIENT_RESOURCES;
        DoTraceLevelMessage(DriverGlobals, TRACE_LEVEL_ERROR, TRACINGDRIVER,
            "ERROR: ExAllocatePoolWithTag failed with Status 0x%x\n", status);
        goto cleanUp;
    }

    RtlZeroMemory(ImageName->Buffer, size);
    ImageName->Length = 0x0;
    ImageName->MaximumLength = size;

    status = RtlUnicodeStringCopy(ImageName, &imageName);

    //
    // The copy cannot fail since we setup the buffer to hold enough space for
    // the contents of the ImagePath value.
    //
    ASSERT(NT_SUCCESS(status));

cleanUp:

    if (value != NULL) {
        FxPoolFree(value);
    }

    return status;
}


_Must_inspect_result_
__drv_maxIRQL(PASSIVE_LEVEL)
NTSTATUS
QueryAndAllocString(
    _In_  HANDLE Key,
    _In_  PFX_DRIVER_GLOBALS Globals,
    _In_  PCUNICODE_STRING ValueName,
    _Out_ PKEY_VALUE_PARTIAL_INFORMATION* Info
    )
{
    PKEY_VALUE_PARTIAL_INFORMATION info;
    NTSTATUS status;
    ULONG length;

    status = STATUS_UNSUCCESSFUL;
    info = NULL;

    ASSERT(Info != NULL);
    *Info = NULL;

    status = Mx::MxQueryValueKey(Key,
                             (PUNICODE_STRING)ValueName,
                             KeyValuePartialInformation,
                             NULL,
                             0,
                             &length);

    if (!NT_SUCCESS(status) && status != STATUS_BUFFER_TOO_SMALL) {
        goto cleanup;
    }

    //
    // Pool can be paged b/c we are running at PASSIVE_LEVEL and we are going
    // to free it at the end of this function.
    //
    status = RtlULongAdd(length,
                         FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data),
                         &length);

    if (!NT_SUCCESS(status)) {
        goto cleanup;
    }

    info = (PKEY_VALUE_PARTIAL_INFORMATION) FxPoolAllocate(Globals,
                                                           PagedPool,
                                                           length);

    if (info == NULL) {
        status = STATUS_INSUFFICIENT_RESOURCES;
        goto cleanup;
    }

    RtlZeroMemory(info, length);

    //
    // Query registry for the data under ValueName
    //
    status = Mx::MxQueryValueKey(Key,
                             (PUNICODE_STRING) ValueName,
                             KeyValuePartialInformation,
                             info,
                             length,
                             &length);


    if (NT_SUCCESS(status)) {
        if (info->Type != REG_SZ && info->Type != REG_EXPAND_SZ) {
            status = STATUS_OBJECT_TYPE_MISMATCH;
            goto cleanup;
        }

        if (info->DataLength == 0 ||
            (info->DataLength % 2) != 0 ||
            (info->DataLength >
            (length - FIELD_OFFSET(KEY_VALUE_PARTIAL_INFORMATION, Data)))) {
            status = STATUS_INVALID_PARAMETER;
            goto cleanup;
        }

        *Info = info;
    }

cleanup:

    if (!NT_SUCCESS(status)) {
        if (info != NULL) {
            FxPoolFree(info);
        }
    }

    return status;
}