Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Best Of
Re: IOCTL or shared event for fast(frequently) communication
Anton beat me too it, but keyboard input might have been high speed in 1980, but it is certainly not in 2020. But it is also clear that the threading model needs work too. With or without IOCP, the stock thread pool, or anything custom, you should be able to handle this level of load with a single thread and >1% CPU usage. You should also evaluate your expectations if you think that 15 pending IRPs is a lot. Think 1,500 before you start to worry on commodity hardware and many thousands on specialized systems
MBond2
Re: Memory usage of UMDF2 Serial Driver
Does the memory foot print shows the combined memory usage of device drivers and its underlying systems (e.g. reflector etc)?
No.
May i know why this fluctuation in memory of host process?
I’m guessing, since I’m not looking at your system, but it SOUNDS like working set trimming.
Still... you said there’s a 3 GB gain... I’m not sure worrying about a 1 MB growth is looking in the right direction.
Peter
Re: Driver Signing options for an independent developer
... try to find someone with a business which would want to buy the certificate for me and I'm gonna pay for it.
As a young and idealistic student 
, I don't think you appreciate what you're asking here. There are legal implications that would make such a tactic extremely unwise.
An EV certificate is a legal statement by a certificate provider saying "I have verified through multiple mechanisms that the company named in this certificate is who they say they are, and that the holder of this certificate is authorized to act on behalf of the company." I don't think you'll find a company who is willing to authorize you to act on their behalf.
As I mentioned, you use that certificate to open a hardware dashboard account with Microsoft. Opening that account requires you to sign a number of legal documents on behalf of the company, such as a codes of conduct and authorizations. Unless you are an employee, you could not in good faith sign most of those documents.
It's an ugly situation, and it makes Linux look more and more appealing.
Re: Performance Issue in Driver due to Processor C state wakeup delay
I have had similar issues with USB 3 device drivers. As i recall, the USB host was generating Missed Service Errors on Isoch out transfers even though the transfers were submitted with plenty of time. The root cause was increase in PCIe response latency caused by the processor entering a lower power state. The host wasn't able to read the data from system memory before the microframe ended do to the increase in PCIe latency. Normally PCIe latency is very small, well under 10 microseconds. When the latency gets up above 50us, it gets hard to transfer a lot of data in a 128us microframe.
You may be able to get some info out of the system on average and max PCIe request latency.
This was several years ago and I haven't tested on recent intel CPUs.
Eric
Re: Help on Minispy File System Minifilter Driver.
Minispy sets the "suppress automatic attachment" bit in the instance flags:
;Instances specific information. DefaultInstance = "Minispy - Top Instance" Instance1.Name = "Minispy - Middle Instance" Instance1.Altitude = "370000" Instance1.Flags = 0x1 ; Suppress automatic attachments Instance2.Name = "Minispy - Bottom Instance" Instance2.Altitude = "361000" Instance2.Flags = 0x1 ; Suppress automatic attachments Instance3.Name = "Minispy - Top Instance" Instance3.Altitude = "385100" Instance3.Flags = 0x1 ; Suppress automatic attachments
Set Flags to zero and you'll automatically attach.
Re: Conditioanal variable in kernel
It is exported, but it is undocumented. Surely you can find a better method that is supported.
Re: Use minifilter driver to help enforce shared file access control
An update of this problem:
The problem where the executable built from VS on the network share hangs is caused by a deadlock.
Here is the sequence of events leading to the deadlock:
1. The VS-built executable on the share starts to run, opening itself or a DLL which is also on the share.
2. The driver's pre_create callback is called and it calls FltSendMessage to send a log (executable PID and the target file) to the user level monitoring process which is responsible for receiving messages from the driver-user queue.
3. The user level monitoring process tries to get the executable's full path from its PID, by calling OpenProcess(PID) and QueryFullProcessImageName().
4. The OpenProcess(PID) triggers another IRP_MJ_CREATE, causing the pre_create callback to be called again. At this point the user level monitoring process blocks in OpenProcess().
5. Because the target executable file is on the monitored share, pre_create callback calls FltSendMessage() again to log its open.
6. Because the user level monitoring process is being blocked inside OpenProcess(), it can't drain the driver-user message queue, leading to a deadlock.
The solution is to return FLT_PREOP_SUCCESS_NO_CALLBACK in step 5 above, without calling FltSendMessage because we don't need to worry about our own monitoring process for issuing illegal file access and hence there is no need to log its access to the file on the share.
Thanks Scott again for the help!
Youlin
Re: IOCTL or shared event for fast(frequently) communication
Isn't a handle thread-specific and not safe to call from another thread
There are good books such as ‘windows system programming’ by Johnson Hart and ‘windows internals’ by Mark Russinovich
Re: IOCTL or shared event for fast(frequently) communication
Isn't a handle thread-specific
No. Handles are PROCESS specific (they live in the process handle table) not thread specific.
it means I can call DeviceIoControl to open another IOCTL directly inside the completion port callback
That's exactly what most people do.
Peter
Re: netvmini sample
#define NDIS_STATUS_BAD_CHARACTERISTICS ((NDIS_STATUS)0xC0010005L)
Do you have a [DeviceInstall32] section? If so, the system will create a devnode for you automatically in addition to the one "devcon install" creates. You might consider using pnputil instead.