Driver warning 28155

NTDEV
1

Hi,
I have a working, runnable driver which gives a few warnings from the Microsoft code review tool (listed at the bottom of this message). The warnings are coming from the fact that to tidy my code I’ve put the major dispatch calls in functions outside of the main function rather than having a big case list. For example I’ve got a global function:

/*++
Driver Unload routine
–*/
VOID DoUnloadDriver(IN PDRIVER_OBJECT dro)
{
stuff
}

which is called from the main routine:

if (NT_SUCCESS(ntStatus))
{
if (NT_SUCCESS(ntStatus))
{
//Dispatch functions
DriverObject->MajorFunction[IRP_MJ_CREATE]=DoCreate;
DriverObject->MajorFunction[IRP_MJ_CLOSE]=DoClose;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=DoDeviceControl;
DriverObject->DriverUnload=DoUnloadDriver; <<<<<<

I’ve tried following the recommendation that comes with the warning but maybe I’m getting the syntax wrong. Is there an easy way of eliminating the warning?

Thanks,
Brian.

28101
The Drivers module has inferred that the current function is a DRIVER_INITIALIZE function: This is informational only. No problem has been detected.
DriverEntry
660


  • -
    694
    45
    artdrv.c
    c:\art_soft\artdrv</filepath>

    28155
    The function being assigned or passed should be a DRIVER_DISPATCH function: Add the declaration ‘DRIVER_DISPATCH DoCreate;’ before the current first declaration of DoCreate.
    DriverEntry
    660


  • -
    695
    44
    artdrv.c
    c:\art_soft\artdrv</filepath>

    28155
    The function being assigned or passed should be a DRIVER_DISPATCH function: Add the declaration ‘DRIVER_DISPATCH DoClose;’ before the current first declaration of DoClose.
    DriverEntry
    660
2

On 03/10/2011 10:58 AM, xxxxx@appliedrelaytesting.co.uk wrote:

[from the 28155 warning description]

The function being assigned or passed should be a DRIVER_DISPATCH
function: Add the declaration ‘DRIVER_DISPATCH DoCreate;’ before the
current first declaration of DoCreate.

Well, for me it looks like you need just a

DRIVER_DISPATCH DoUnloadDriver;

before the implementation of the function DoUnloadDriver.

3

You would think so. I’ve tried several constructions but your suggested:

/*++
Driver Unload routine
–*/
DRIVER_DISPATCH DoUnloadDriver;
VOID DoUnloadDriver(IN PDRIVER_OBJECT dro)

Gives me:
1>errors in directory c:\art_soft\artdrv
1>c:\art_soft\artdrv\artdrv.c(340) : error C2371: ‘DoUnloadDriver’ : redefinition; different basic types

I will investigate further.
Brian.

4

The unload routine is not a DRIVER_DISPATCH routine that type is for
things like read, write, ioctl etc. Use DRIVER_ULOAD in this case.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@appliedrelaytesting.co.uk”
wrote in message
news:xxxxx@ntdev:

> You would think so. I’ve tried several constructions but your suggested:
>
> /++
> Driver Unload routine
> –/
> DRIVER_DISPATCH DoUnloadDriver;
> VOID DoUnloadDriver(IN PDRIVER_OBJECT dro)
>
>
> Gives me:
> 1>errors in directory c:\art_soft\artdrv
> 1>c:\art_soft\artdrv\artdrv.c(340) : error C2371: ‘DoUnloadDriver’ : redefinition; different basic types
>
> I will investigate further.
> Brian.

5

On 03/10/2011 04:31 PM, xxxxx@appliedrelaytesting.co.uk wrote:

You would think so. I’ve tried several constructions but your suggested:
[…error message…]
I will investigate further.
Brian.

Ever used Google before? With “DRIVER_DISPATCH” I found this:

http://msdn.microsoft.com/en-us/library/ff544652(v=vs.85).aspx

…which is for WDM, the others (KMDF/NDIS) can be reached via:

http://msdn.microsoft.com/en-us/library/ff554115(v=VS.85).aspx

6

Yes, you are right :slight_smile: After significant googling and playing I see that I need a couple of lines before each function such as:

__drv_dispatchType(IRP_MJ_CLOSE) <<<< new line
DRIVER_DISPATCH DoClose; <<< new line
NTSTATUS DoClose(IN PDEVICE_OBJECT fdo, IN PIRP irp)

And as you said Don, each type is different.

With all that done, I now get no PreFast warnings. It’s actually a rather useful tool.
Thanks for all your help.
Brian

7

xxxxx@appliedrelaytesting.co.uk wrote:

Yes, you are right :slight_smile: After significant googling and playing I see that I need a couple of lines before each function such as:

__drv_dispatchType(IRP_MJ_CLOSE) <<<< new line
DRIVER_DISPATCH DoClose; <<< new line
NTSTATUS DoClose(IN PDEVICE_OBJECT fdo, IN PIRP irp)

OK, but DRIVER_DISPATCH is a prototype. It needs to be visible to the
functions that REFER to DoClose. It might work because of the ordering
of your source, but it would be more appropriate to move the
DRIVER_DISPATCH and DRIVER_UNLOAD declarations to the include file that
has the prototypes for those functions.

In fact, you might just want to replace the prototypes you have with these.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.