RtlInitializebitmap can not be called in DISPATCH_LEVEL

NTDEV
1

We are developing storage filter ( above disk class) driver in windows 7. For some purpose we are using Rtl*** bitmap functions.

If we use RtlInitializebitmap after acquiring the spin lock, it works fine.
However if we enable driver verfier, It gives crashes saying IRQL level issue.

I checked wdm.h where this API is declared and it says _drv_max_irql(APC_LEVEL).

Inputs to RtlInitializebitmap belog to NonPagedMemory.

Looks like this function does not do anything more except intialize RTL structure.
If I do Following instead of RtlInitializebitmap, It works fine:

pRtlBitmap->Buffer = myBuffer;
pRtlBitmap->SizeOfBitmap = _myBufferSizeInBits;

Help in DDK says that We can not call above APC_LEVEL but online msdn says we can call at any level if variables belong to non paged memory.

Thanks in advance.

2

Can you provide the !analyze -v output? It sure looks to me like
RtlInitializeBitmap is located in a pageable section, which would prevent
you from calling it at IRQL >= DISPATCH_LEVEL (regardless of the input). It
also looks like it might no longer be in a pageable section on Win8, which
would explain the lifting of the restriction.

-scott
OSR

wrote in message news:xxxxx@ntdev…

We are developing storage filter ( above disk class) driver in windows 7.
For some purpose we are using Rtl*** bitmap functions.

If we use RtlInitializebitmap after acquiring the spin lock, it works fine.
However if we enable driver verfier, It gives crashes saying IRQL level
issue.

I checked wdm.h where this API is declared and it says
_drv_max_irql(APC_LEVEL).

Inputs to RtlInitializebitmap belog to NonPagedMemory.

Looks like this function does not do anything more except intialize RTL
structure.
If I do Following instead of RtlInitializebitmap, It works fine:

pRtlBitmap->Buffer = myBuffer;
pRtlBitmap->SizeOfBitmap = _myBufferSizeInBits;

Help in DDK says that We can not call above APC_LEVEL but online msdn says
we can call at any level if variables belong to non paged memory.

Thanks in advance.

3

> Help in DDK says that We can not call above APC_LEVEL but online msdn says we can call

at any level if variables belong to non paged memory.

Don’t forget that Windows kernel code, as long as it resides in pageable code section, can be paged out.
Therefore, if your target function somehow touches the pageable code…well, at this point the results that you get under Verifier’s become perfectly understandable…

Anton Bassov