Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

KeWaitForSingleObject raising level to DISPATCH_LEVEL?

matt_sykesmatt_sykes Member - All Emails Posts: 290
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL

fffff800`7524551a : nt!KiPageFault+0x247
fffff8380`9dd062c0 : nt!KeWaitForSingleObject+0x34a
ffff8380`9dd06370 : nt!ViKeWaitForSingleObjectCommon+0x92
ffff8380`9dd063c0 : nt!VerifierKeWaitForSingleObject+0x1e
ffff8380`9dd06400 : AHKFilterBus!FPFilterRemoveDevice+0x39d [c:\ahkfilter\bus\pnp.c @ 662]"

The filter is responding to an IRP_MN_REMOVE_DEVICE and stepping through the handler the irql is passive, untill the call to KeWait, then it goes to dispatch:

1: kd> !irql
Debugger saved IRQL for processor 0x1 -- 0 (LOW_LEVEL)
1: kd> p <----- steps over KeWait
KDTARGET: Refreshing KD connection

*** Fatal System Error: 0x0000000a

WARNING: This break is not a step/trace completion.
The last command has been cleared to prevent
accidental continuation of this unrelated event.
Check the event, location and thread before resuming.
Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

fffff801`b1fd4a60 cc int 3
1: kd> !irql
Debugger saved IRQL for processor 0x1 -- 2 (DISPATCH_LEVEL)"

The event is a NotificationEvent, created signaled, KeResetEvent and KeSetEvent have not been called on it, so KeWait should complete immediately.

The call to the wait is: KeWaitForSingleObject(&evt, Executive, KernelMode, FALSE, NULL);

There are no locks held during the call to KeWait.

Does anyone at MSFT want the dump to look at?


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA