Hi ,
i’m trying to build a WDM driver for a legacy serial device which act more
or less like a mouse
i used the polling sample from W.Oney s book .
the sample need a usermode event to start polling the device but i wanted to
start polling the device immediatly untill i remove it .
as my device doesnt give a pnp id , i get a SerialDeviceObject pointer
calling IoGetDeviceObjectPointer in my STARTDEVICE
i must have done something terribly wrong but i dont anderstand why i get a
BSOD.
here’s the modified pollingthreadroutine code :
VOID PollingThreadRoutine(PDEVICE_EXTENSION pdx)
{ // PollingThreadRoutine
NTSTATUS status;
KTIMER timer;
KEVENT evt;
IO_STATUS_BLOCK IoStatusBlock;
PIRP Irp;
KeInitializeTimerEx(&timer, SynchronizationTimer);
PVOID pollevents = {
(PVOID) &pdx->evKill,
(PVOID) &timer,
};
C_ASSERT(arraysize(pollevents) <= THREAD_WAIT_OBJECTS);
LARGE_INTEGER duetime = {0};
#define POLLING_INTERVAL 500
KeSetTimerEx(&timer, duetime, POLLING_INTERVAL, NULL);
KdPrint((DRIVERNAME" - Entering poll loop …\n"));
while(TRUE)
{
// Block until time to poll again.
status = KeWaitForMultipleObjects(arraysize(pollevents),
pollevents, WaitAny, Executive, KernelMode, FALSE, NULL, NULL);
if (!NT_SUCCESS(status))
{
KdPrint((DRIVERNAME " - KeWaitForMultipleObjects failed - %X\n",
status));
break;
}
if (status == STATUS_WAIT_0)
{
status = STATUS_DELETE_PENDING;
break;
}
// Read Device .
KeInitializeEvent(&evt, NotificationEvent, FALSE);
Irp = IoBuildDeviceIoControlRequest (IRP_MJ_READ,pdx->SerialDeviceObject,
NULL,0,pdx->data,sizeof(pdx->data),FALSE,&evt,&IoStatusBlock);
if (Irp != NULL)
{// SEND READ IRP
status = IoCallDriver(pdx->SerialDeviceObject,Irp);
// If pending wait for completion
if (status == STATUS_PENDING)
{
KeWaitForSingleObject(&evt, Executive, KernelMode, FALSE,NULL);
status = IoStatusBlock.Status;
}
}
else
{
KdPrint((DRIVERNAME " - IoBuildDeviceIoControlRequest failed.
STATUS_INSUFFICIENT_RESOURCES\n"));
break;
}
}
KeCancelTimer(&timer);
PsTerminateSystemThread(STATUS_SUCCESS);
}
and here’s the bugcheck analysis :
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at
an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804eda63, address which referenced memory
Debugging Details:
WRITE_ADDRESS: 00000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeWaitForMultipleObjects+23d
804eda63 8902 mov [edx],eax
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from f33f441e to 804eda63
TRAP_FRAME: fca00c84 – (.trap fffffffffca00c84)
ErrCode = 00000002
eax=8122d090 ebx=8122d090 ecx=811f6e74 edx=00000000 esi=8122d020
edi=00000000
eip=804eda63 esp=fca00cf8 ebp=fca00d28 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nt!KeWaitForMultipleObjects+0x23d:
804eda63 8902 mov [edx],eax
Resetting default scope
STACK_TEXT:
fca00d28 f33f441e 00000002 fca00da0 00000001
nt!KeWaitForMultipleObjects+0x23d
fca00dac 8057c73a 811f6e00 00000000 00000000
mmtser!PollingThreadRoutine+0x78 [c:\stock\projet\mmtser\readwrite.cpp @
167]
fca00ddc 805124c1 f33f43a6 811f6e00 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
mmtser!PollingThreadRoutine+78 [c:\stock\projet\mmtser\readwrite.cpp @ 167]
f33f441e 8945b4 mov [ebp-0x4c],eax
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: mmtser!PollingThreadRoutine+78
MODULE_NAME: mmtser
IMAGE_NAME: mmtser.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 415141ee
STACK_COMMAND: .trap fffffffffca00c84 ; kb
BUCKET_ID: 0xA_W_mmtser!PollingThreadRoutine+78
Followup: MachineOwner