When I run my driver under Windows XP…and read/write to it from a sample app I don’t receive any errors. However, when I run the same driver under Windows 7, I receive a bug check once I read/write to the driver. CreateFile works fine, but once ReadFile or WriteFile is executed, I received a BSOD. I have placed the EvtRead/EvtWrite functions below along with the analysis. In this basic driver, it just handles basic read/writes.
///////////////////////////
#include “ProtoTypes.h”
VOID
BasicEvtRead(
IN WDFQUEUE Queue,
IN WDFREQUEST Request,
IN size_t Length
)
/*++
Routine Description:
This event is called when the framework receives IRP_MJ_READ requests.
Arguments:
Queue - Handle to the framework queue object that is associated with the
I/O request.
Request - Handle to a framework request object.
Length - number of bytes to be written.
Queue is by default configured to fail zero length read & write requests.
Return Value:
None
–*/
{
NTSTATUS status = STATUS_SUCCESS;
PRESPONSE output_buffer;
PDEVICE_CONTEXT devExt;
PBASIC_FILEOBJECT_CONTEXT file_object_context;
ULONG_PTR bytesWritten = 0;
size_t output_buffer_length;
// Get a pointer to our device extension
devExt = BasicGetDeviceContext( WdfIoQueueGetDevice(Queue) );
// Get a pointer to our file object context
file_object_context = BasicGetFileObjectData(WdfRequestGetFileObject(Request));
//
// Get the response buffer. Since the device is set to do buffered
// I/O, this function will retrieve Irp->AssociatedIrp.SystemBuffer.
//
status = WdfRequestRetrieveOutputBuffer(Request,0, &output_buffer, &output_buffer_length);
if(!NT_SUCCESS(status))
{
WdfRequestComplete(Request, status);
return;
}
else{
switch (file_object_context->function_code)
{
case 0x1:
output_buffer->function_code = (file_object_context->function_code);
output_buffer->data = 2390;
bytesWritten = Length;
break;
default:
bytesWritten = 0;
}
}
WdfRequestCompleteWithInformation(Request, status, bytesWritten);
}
VOID
BasicEvtWrite (
WDFQUEUE Queue,
WDFREQUEST Request,
size_t Length
)
/*++
Routine Description:
Performs read from the toaster device. This event is called when the
framework receives IRP_MJ_READ requests.
Arguments:
Queue - Handle to the framework queue object that is associated with the
I/O request.
Request - Handle to a framework request object.
Lenght - Length of the data buffer associated with the request.
By default, the queue does not dispatch
zero length read & write requests to the driver and instead to
complete such requests with status success. So we will never get
a zero length request.
Return Value:
None.
–*/
{
NTSTATUS status = STATUS_SUCCESS;
PDEVICE_CONTEXT devExt;
PBASIC_FILEOBJECT_CONTEXT file_object_context;
PREQUEST input_buffer;
ULONG_PTR bytesWritten = 0;
size_t input_buffer_length;
// Get a pointer to our device extension
devExt = BasicGetDeviceContext( WdfIoQueueGetDevice(Queue) );
// Get a pointer to our file object context
file_object_context = BasicGetFileObjectData(WdfRequestGetFileObject(Request));
//
// Get the request memory and perform read operation here
//
status = WdfRequestRetrieveInputBuffer(Request, 0, &input_buffer, &input_buffer_length);
if( NT_SUCCESS(status) )
{
file_object_context->function_code = (input_buffer->function_code);
bytesWritten = Length;
}
else
{
WdfRequestComplete(Request, status);
return;
}
WdfRequestCompleteWithInformation(Request, status, bytesWritten);
}
VOID
BasicEvtDeviceControl(
IN WDFQUEUE Queue,
IN WDFREQUEST Request,
IN size_t OutputBufferLength,
IN size_t InputBufferLength,
IN ULONG IoControlCode
)
/*++
Routine Description:
This event is called when the framework receives IRP_MJ_DEVICE_CONTROL
requests from the system.
Arguments:
Queue - Handle to the framework queue object that is associated
with the I/O request.
Request - Handle to a framework request object.
OutputBufferLength - length of the request’s output buffer,
if an output buffer is available.
InputBufferLength - length of the request’s input buffer,
if an input buffer is available.
IoControlCode - the driver-defined or system-defined I/O control code
(IOCTL) that is associated with the request.
Return Value:
VOID
–*/
{
NTSTATUS status= STATUS_SUCCESS;
UNREFERENCED_PARAMETER(Queue);
UNREFERENCED_PARAMETER(OutputBufferLength);
UNREFERENCED_PARAMETER(InputBufferLength);
//
// Use WdfRequestRetrieveInputBuffer and WdfRequestRetrieveOutputBuffer
// to get the request buffers.
//
switch (IoControlCode) {
default:
status = STATUS_INVALID_DEVICE_REQUEST;
}
//
// Complete the Request.
//
WdfRequestCompleteWithInformation(Request, status, (ULONG_PTR) 0);
}
/////////////////////
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but …
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000420, The exception code that was not handled
Arg2: bc385595, The address that the exception occurred at
Arg3: b6293afc, Trap Frame
Arg4: 00000000
Debugging Details:
*** ERROR: Module load completed but symbols could not be loaded for basic.sys
EXCEPTION_CODE: (NTSTATUS) 0xc0000420 - An assertion failure has occurred.
FAULTING_IP:
basic+1595
bc385595 cd2c int 2Ch
TRAP_FRAME: b6293afc – (.trap 0xffffffffb6293afc)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000002 edx=00000065 esi=8537c28c edi=8537c1b0
eip=bc385595 esp=b6293b70 ebp=b6293b70 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
basic+0x1595:
bc385595 cd2c int 2Ch
Resetting default scope
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: DriverTest.exe
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 82ad004c to 82af9eb4
STACK_TEXT:
b6293664 82ad004c 0000008e c0000420 bc385595 nt!KeBugCheckEx+0x1e
b6293a8c 82a59de6 b6293aa8 00000000 b6293afc nt!KiDispatchException+0x1ac
b6293af4 82a59d82 b6293b70 bc385597 badb0d00 nt!CommonDispatchException+0x4a
b6293b14 82a80654 76c89001 000001cb 000001c0 nt!Kei386EoiHelper+0x17a
b6293b70 bc3854c0 855fcaa8 855fcaa0 00000000 nt!MiUpdateWsle+0x231
WARNING: Stack unwind information not available. Following frames may be wrong.
b6293b94 8af1802a 7ac83e48 77105580 00000004 basic+0x14c0
b6293bb0 8af19256 7ac83e48 77105580 00000004 Wdf01000!FxIoQueueIoRead::Invoke+0x2a
b6293bd8 8af1b9ac 77105580 88efaa78 8537c1b0 Wdf01000!FxIoQueue::DispatchRequestToDriver+0x1a3
b6293bf4 8af1ca36 8537c100 00000000 88f544f8 Wdf01000!FxIoQueue::DispatchEvents+0x3be
b6293c14 8af1e824 88efaa78 8849ab60 8789b030 Wdf01000!FxIoQueue::QueueRequest+0x1ec
b6293c38 8af0da3f 878bd2a0 b6293c5c 82a5258e Wdf01000!FxPkgIo::Dispatch+0x27d
b6293c44 82a5258e 8789b030 878bd2a0 878bd2a0 Wdf01000!FxDevice::Dispatch+0x7f
b6293c5c 82c45a31 878bd2a0 878bd334 8849ab60 nt!IofCallDriver+0x63
b6293c7c 82c7e380 8789b030 8849ab60 00000001 nt!IopSynchronousServiceTail+0x1f8
b6293d08 82a591fa 8789b030 878bd2a0 00000000 nt!NtReadFile+0x644
b6293d08 771870b4 8789b030 878bd2a0 00000000 nt!KiFastCallEntry+0x12a
0030f8e4 00000000 00000000 00000000 00000000 0x771870b4
STACK_COMMAND: kb
FOLLOWUP_IP:
basic+1595
bc385595 cd2c int 2Ch
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: basic+1595
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: basic
IMAGE_NAME: basic.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e4da09e
FAILURE_BUCKET_ID: 0x8E_basic+1595
BUCKET_ID: 0x8E_basic+1595