Does a KMDF driver need to delete a KEVENT that it creates?

NTDEV
1

I create an event for use in a synchronous request to a device. The
following is the pertinent code:

KEVENT event;
IO_STATUS_BLOCK iosb;

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, DEVICE_OBJ, readBuffer,
17, 0, &event, &iosb);

timeout.QuadPart = Int32x32To64(-1, 1000 * 100 * 10); // should be 0.1
sec (relative)
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);

Do I need to delete this event after completion of the request or can it be
reused each time the associated function is called?

Randy

2

There is no matching free for the init call. Assuming the event is on the stack, each caller has its own event and there is nothing to worry about

Sent from my Windows 10 phone

From: Randy Lewismailto:xxxxx
Sent: Saturday, March 19, 2016 8:50 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Does a KMDF driver need to delete a KEVENT that it creates?

I create an event for use in a synchronous request to a device. The following is the pertinent code:

KEVENT event;
IO_STATUS_BLOCK iosb;

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, DEVICE_OBJ, readBuffer, 17, 0, &event, &iosb);

timeout.QuadPart = Int32x32To64(-1, 1000 * 100 * 10); // should be 0.1 sec (relative)
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);

Do I need to delete this event after completion of the request or can it be reused each time the associated function is called?

Randy

— NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at</mailto:xxxxx></mailto:xxxxx>

3

You don’t need to delete the event, it is reusable. The bigger question is why you are not using WdfRequestSend instead of messing with the raw IRP’s?

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Randy Lewis
Sent: Saturday, March 19, 2016 11:50 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Does a KMDF driver need to delete a KEVENT that it creates?

I create an event for use in a synchronous request to a device. The following is the pertinent code:

KEVENT event;
IO_STATUS_BLOCK iosb;

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, DEVICE_OBJ, readBuffer, 17, 0, &event, &iosb);

timeout.QuadPart = Int32x32To64(-1, 1000 * 100 * 10); // should be 0.1 sec (relative)
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);

Do I need to delete this event after completion of the request or can it be reused each time the associated function is called?

Randy

— NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at

4

Don, thanks for the reply. I’m using IRPs instead of Requests because I’m dealing with a HIDCLASS device and I could not make the WdfRequest methods work to read data from my device. I was getting STATUS_PRIVILEDGE_NOT_HELD returned from WdfRequestSend. After a lengthy osronline Q&A session on this, without resolution, I switched to the IRP methods and got them to work. It’s possible that with what I learned working with the IRPs (I had to assign a PFILE_OBJECT to the IO_STACK_LOCATION), I could make the Request methods work, but I’m content for now to just have something working. Interfacing with HIDCLASS seems to be full of pitfalls and I think I have hit them all on this project.

5

Don,

Inspired by your question I took another crack at getting the WdfRequest methods to work. After a number of failures and a few system crashes I guess I’ll stick with the IRP methods.

Randy

6

>Do I need to delete this event after completion of the request

No. KEVENT has no destructor.

Just ensure no one is waiting and no one is doing set/reset on the on-stack event which went out of scope.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

7

>WdfRequestSend instead of messing with the raw IRP’s?

Because KMDF request formatting wrappers are often more heavyweight then raw IRPs, and the code is much harder to read.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

8

Assuming the event is on the stack, and assuming that there aren’t any threads waiting on the event at the time you unwind, and assuming that no caller will attempt to set or clear the event (or wait on it) after you unwind, then there’s nothing needed to delete the event. It just evaporates and no one cares.

If someone is going to try and touch the event after you unwind, then all sorts of bad ensues.

-p

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Saturday, March 19, 2016 9:07 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Does a KMDF driver need to delete a KEVENT that it creates?

There is no matching free for the init call. Assuming the event is on the stack, each caller has its own event and there is nothing to worry about

Sent from my Windows 10 phone

From: Randy Lewismailto:xxxxx
Sent: Saturday, March 19, 2016 8:50 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Does a KMDF driver need to delete a KEVENT that it creates?

I create an event for use in a synchronous request to a device. The following is the pertinent code:

KEVENT event;
IO_STATUS_BLOCK iosb;

KeInitializeEvent(&event, NotificationEvent, FALSE);
irp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, DEVICE_OBJ, readBuffer, 17, 0, &event, &iosb);

timeout.QuadPart = Int32x32To64(-1, 1000 * 100 * 10); // should be 0.1 sec (relative)
KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, &timeout);

Do I need to delete this event after completion of the request or can it be reused each time the associated function is called?

Randy
— NTDEV is sponsored by OSR Visit the list online at: MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at To unsubscribe, visit the List Server section of OSR Online at

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:></mailto:xxxxx></mailto:xxxxx>