The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I am working on implementing a control driver tied with a user-space application. The control driver publishes a driver-defined interface (DDI) is using WdfDeviceAddQueryInterface(), which gets used by other KMDF driver to service the IOCTL requests received from the user-space app.
RtlZeroMemory(&sampleInterface, sizeof(sampleInterface)); sampleInterface.InterfaceHeader.Size = sizeof(sampleInterface); sampleInterface.InterfaceHeader.Version = SAMPLE_INTERFACE_VERSION; sampleInterface.InterfaceHeader.InterfaceReference = WdfDeviceInterfaceReferenceNoOp; sampleInterface.InterfaceHeader.InterfaceDereference = WdfDeviceInterfaceDereferenceNoOp; sampleInterface.SampleCallback = SampleCallback; WDF_QUERY_INTERFACE_CONFIG_INIT( &wdfQueryInterfaceConfig, (PINTERFACE)&sampleInterface, &GUID_SAMPLE_INTERFACE_GUID, NULL); status = WdfDeviceAddQueryInterface( device, &wdfQueryInterfaceConfig);
When the control-driver publishes the DDI using WdfDeviceAddQueryInterface() this is resulting in a Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
nt!DbgBreakPoint nt!KiBugCheckDebugBreak+0x1c nt!KeBugCheck2+0x870 nt!KeBugCheckEx+0x18 nt!KiAbortException+0x1863f0 nt!KiSynchronousException+0x70 nt!KzSynchronousException+0x24 nt!KiArm64ExceptionVectors+0x5c nt!KiInitializeWaitBlock+0x24 nt!KeWaitForSingleObject+0x11c Wdf01000.sys -> Wdf01000.sys Wdf01000!MxEvent::WaitFor+0x20 Wdf01000!FxWaitLockInternal::AcquireLock+0x60 Wdf01000!FxPkgPnp::AddQueryInterface+0x14 Wdf01000!imp_WdfDeviceAddQueryInterface+0x2a0 xxxxx!WdfDeviceAddQueryInterface+0x24 xxxxx!OnCreateDevice+0x57c xxxxx!OnDeviceAdd+0x5c xxxxx!DriverEntry+0x2a0 xxxxx!FxDriverEntryWorker+0xc4 xxxxx!FxDriverEntry+0x24 nt!PnpCallDriverEntry+0x44 kd> !irql Debugger saved IRQL for processor 0x6 -- 2 (DISPATCH_LEVEL) [Dispatcher interrupt level]
I see similar implementations for publishing a DDI, from the MSDN and other KMDF drivers usage.
Have a couple of queries related to the above:
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Writing WDF Drivers||7 Dec 2020||LIVE ONLINE|
|Internals & Software Drivers||25 Jan 2021||LIVE ONLINE|
|Developing Minifilters||8 March 2021||LIVE ONLINE|