ObReferenceObjectByHandle - does it stop object being paged out?

NTDEV
1

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

2

>ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

If it is possible for dispatcher objects to be paged out, I think the OS
would not work. Are you certain that when you do the
ObReferenceObjectByHandle() that you are in the context of the user? If so,
the only thing I see you doing different than I do is that I use
“SYNCHRONIZE” as the second parameter. I also use HANDLE as the object type
and don’t use a ( PVOID * ) cast. My latest implementation uses a UNION to
handle the problems with 64-bit support. You have to account on a 64-bit
driver having to support both 32-bit and 64-bit handles from user mode. The
UNION forces the size to be 64-bits even in the 32-bit version.

“Mike Kemp” wrote in message news:xxxxx@ntdev…
> Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
> is passed into my driver so I can signal an event.
>
> ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
> ExEventObjectType, Irp->RequestorMode, (PVOID) &pkNotifyAppEvent, NULL);
> …(checking okay here, then)
> pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;
>
> so that later in a callback handler in the driver I can tell the user that
> something has happened
>
> KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);
>
> My problem is that this seems to work okay until I make the system a bit
> busier by increasing data throughput. I don’t get a crash, mainly the
> callbacks stop - I’m still investigating.
>
> However I wonder if someone can answer a question for me.
>
> ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
> event, and guarantees that the object is not going to be deleted. But does
> it lock it in memory? If not my problem is probably that the callback at
> DISPATCH_LEVEL is finding that the event is paged out and that’s it.
>
> Thanks, Mike
>
>
>

4

Thanks - this is based on Oney’s example for signalling the app but it is
not clear enough that the KeSetEvent will need to be called at PASSIVE_LEVEL
only in case the event object is paged out.

Interestingly, the event is actually getting signalled - it’s just that
after this the callback stops happening! Before massively reorganising the
code I’m trying to work out if this is really what the problem is likely to
be or it it’s just a blind alley for example, does anyone know what
KeSetEvent() is supposed to do if the object is paged out and it is called
at DISPATCH_LEVEL? I’d have expected a BSOD…

Thanks, Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:25 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

If it is paged out the system is in deep trouble. The create event code
calls the object manager to make a kernel object for the event and these
are in non-paged pool.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Mike Kemp” wrote in message news:xxxxx@ntdev…
> Thanks - this is based on Oney’s example for signalling the app but it is
> not clear enough that the KeSetEvent will need to be called at
> PASSIVE_LEVEL only in case the event object is paged out.
>
> Interestingly, the event is actually getting signalled - it’s just that
> after this the callback stops happening! Before massively reorganising
> the code I’m trying to work out if this is really what the problem is
> likely to be or it it’s just a blind alley for example, does anyone know
> what KeSetEvent() is supposed to do if the object is paged out and it is
> called at DISPATCH_LEVEL? I’d have expected a BSOD…
>
> Thanks, Mike
>
> ----- Original Message -----
> From: Dan Kyler
> To: Windows System Software Devs Interest List
> Sent: Tuesday, December 19, 2006 5:25 PM
> Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object
> being paged out?
>
>
>>ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
> event
>
> No, it does not. It gives you a pointer to a kernel mode dispatcher
> object,
> which just happens to have been created by a call from user mode.
>
> Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the
> event
> was created by a Win32 CreateEvent call, you can bet that it is properly
> allocated from nonpaged pool.
>
> - Dan.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
> Sent: Tuesday, December 19, 2006 10:13 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being
> paged
> out?
>
>
> Hi, I’m using ObReferenceObjectByHandle() to access a user mode event
> that
> is passed into my driver so I can signal an event.
>
> ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
> ExEventObjectType, Irp->RequestorMode, (PVOID) &pkNotifyAppEvent,
> NULL);
> …(checking okay here, then)
> pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;
>
> so that later in a callback handler in the driver I can tell the user
> that
> something has happened
>
> KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);
>
> My problem is that this seems to work okay until I make the system a bit
> busier by increasing data throughput. I don’t get a crash, mainly the
> callbacks stop - I’m still investigating.
>
> However I wonder if someone can answer a question for me.
>
> ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
> event, and guarantees that the object is not going to be deleted. But
> does
> it lock it in memory? If not my problem is probably that the callback at
> DISPATCH_LEVEL is finding that the event is paged out and that’s it.
>
> Thanks, Mike
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

6

ObReferenceObjectByHandle() is being done as soon as the app passes it in.
I’ll check the other params you mention. Thanks for the tips on 64-bit. This
has come up when doing a small change to an existing 32-bit driver. I’m
hoping someone else will do the 64-bit port!

BTW Is there any signficant delay involved in a KeSetEvent()? This is in a
time critical isochronous callback and I know from bitter experience that if
not processed in time the callbacks stop. I may drop it and just get the app
to poll as this particular event is not time critical but more a warning.

  • Mike

----- Original Message -----
From: David J. Craig
Newsgroups: ntdev
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:46 PM
Subject: Re:[ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

If it is possible for dispatcher objects to be paged out, I think the OS
would not work. Are you certain that when you do the
ObReferenceObjectByHandle() that you are in the context of the user? If so,
the only thing I see you doing different than I do is that I use
“SYNCHRONIZE” as the second parameter. I also use HANDLE as the object type
and don’t use a ( PVOID * ) cast. My latest implementation uses a UNION to
handle the problems with 64-bit support. You have to account on a 64-bit
driver having to support both 32-bit and 64-bit handles from user mode. The
UNION forces the size to be 64-bits even in the 32-bit version.

“Mike Kemp” wrote in message news:xxxxx@ntdev…
> Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
> is passed into my driver so I can signal an event.
>
> ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
> ExEventObjectType, Irp->RequestorMode, (PVOID) &pkNotifyAppEvent, NULL);
> …(checking okay here, then)
> pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;
>
> so that later in a callback handler in the driver I can tell the user that
> something has happened
>
> KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);
>
> My problem is that this seems to work okay until I make the system a bit
> busier by increasing data throughput. I don’t get a crash, mainly the
> callbacks stop - I’m still investigating.
>
> However I wonder if someone can answer a question for me.
>
> ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
> event, and guarantees that the object is not going to be deleted. But does
> it lock it in memory? If not my problem is probably that the callback at
> DISPATCH_LEVEL is finding that the event is paged out and that’s it.
>
> Thanks, Mike
>
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

I’ll try to be clearer…

A KEVENT object cannot be paged out. That is not your problem.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 11:06 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

Thanks - this is based on Oney’s example for signalling the app but it is
not clear enough that the KeSetEvent will need to be called at PASSIVE_LEVEL

only in case the event object is paged out.

Interestingly, the event is actually getting signalled - it’s just that
after this the callback stops happening! Before massively reorganising the
code I’m trying to work out if this is really what the problem is likely to
be or it it’s just a blind alley for example, does anyone know what
KeSetEvent() is supposed to do if the object is paged out and it is called
at DISPATCH_LEVEL? I’d have expected a BSOD…

Thanks, Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:25 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

No, the levels at which you can call KeSetEvent are documented in the DDK. Dispatch level is fine (unless you say you will immediately wait).

You would get exactly what you expected. Memory faults at dispatch level are quite fatal.



My best guess is you have a fundamental design issue- perhaps the signal is not causing whatever would normally cause the callbacks (e.g. further I/O) to occur. For instance, if you’re counting asynch I/Os and assuming you get signaled as many times as you sent, then two completions without an intervening send will cause the event to get signaled twice, but you only wake up once (the second signal arriving before your thread begins to run after the first signal). So eventually you reset and wait for another, and it never happens because the count is off.

This signaling method works- I’ve used it plenty (even on Win9x, where it was occasionally ghastly). I’m certain your problem isn’t in the signaling method itself.

9

This is probably the core of the problem, then. Assuming this is a notification event, KeSetEvent makes any waiting threads runnable (subject to possible multiple object waits, etc). It doesn’t guarantee anything about WHEN that thread will actually run. Priority boosts help, but they are still not guarantees. (wrt the qualification, the difference is that if it is a synchronization event, then only ONE waiting thread will become runnable).

10

I got the code for doing event passing from the sample in the DDK. It works
and has never failed me. I am careful to ensure that I follow the same
logic I saw in the sample since using other flags or options might lead into
uncharted waters. KISS is an excellent way to write code.

“Bob Kjelgaard” wrote in message
news:xxxxx@ntdev…



This is probably the core of the problem, then. Assuming this is a
notification event, KeSetEvent makes any waiting threads runnable (subject
to possible multiple object waits, etc). It doesn’t guarantee anything
about WHEN that thread will actually run. Priority boosts help, but they
are still not guarantees. (wrt the qualification, the difference is that if
it is a synchronization event, then only ONE waiting thread will become
runnable).

11

Hi Dan, Sorry, my misreading of your post - it was the end of a long day
yesterday at this end!

Everyone’s input has helped confirm that a paged out event object is not the
problem. I just happened to isolate that if I skipped the KeSetEvent() in
this callback everything works (except of course the app does not see the
event).

Not clear at the moment why the app responding to the event stops the isoch
callbacks as it is quite a different thread mostly signalling the user that
an event has occurred.

My money’s on some delay in KeSetEvent() that is enough to stop further
callbacks (as if a callback is not complete in time for the next it
invariably hangs the 1394 bus driver callback system). I try deferring the
KeSetEvent().

  • Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 6:27 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

I’ll try to be clearer…

A KEVENT object cannot be paged out. That is not your problem.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 11:06 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

Thanks - this is based on Oney’s example for signalling the app but it is
not clear enough that the KeSetEvent will need to be called at PASSIVE_LEVEL

only in case the event object is paged out.

Interestingly, the event is actually getting signalled - it’s just that
after this the callback stops happening! Before massively reorganising the
code I’m trying to work out if this is really what the problem is likely to
be or it it’s just a blind alley for example, does anyone know what
KeSetEvent() is supposed to do if the object is paged out and it is called
at DISPATCH_LEVEL? I’d have expected a BSOD…

Thanks, Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:25 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

12

Hi Folks, Thanks for the help on this. Problem tracked to elsewhere
(consequences, consequences). However it may help people to know that a
KeSetEvent() takes between 5 and 15 uS on 2.66GHz (dual core)CPU. - Mike

----- Original Message -----
From: Mike Kemp
To: Windows System Software Devs Interest List
Sent: Wednesday, December 20, 2006 9:23 AM
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

Hi Dan, Sorry, my misreading of your post - it was the end of a long day
yesterday at this end!

Everyone’s input has helped confirm that a paged out event object is not the
problem. I just happened to isolate that if I skipped the KeSetEvent() in
this callback everything works (except of course the app does not see the
event).

Not clear at the moment why the app responding to the event stops the isoch
callbacks as it is quite a different thread mostly signalling the user that
an event has occurred.

My money’s on some delay in KeSetEvent() that is enough to stop further
callbacks (as if a callback is not complete in time for the next it
invariably hangs the 1394 bus driver callback system). I try deferring the
KeSetEvent().

  • Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 6:27 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

I’ll try to be clearer…

A KEVENT object cannot be paged out. That is not your problem.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 11:06 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

Thanks - this is based on Oney’s example for signalling the app but it is
not clear enough that the KeSetEvent will need to be called at PASSIVE_LEVEL

only in case the event object is paged out.

Interestingly, the event is actually getting signalled - it’s just that
after this the callback stops happening! Before massively reorganising the
code I’m trying to work out if this is really what the problem is likely to
be or it it’s just a blind alley for example, does anyone know what
KeSetEvent() is supposed to do if the object is paged out and it is called
at DISPATCH_LEVEL? I’d have expected a BSOD…

Thanks, Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:25 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged out?

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent, NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

13

Have you considered having the app issue several asynchronous reads at a
time the data that’s coming up the pipe? If you have the app post
enough buffers you could get the data back to it very quickly without
running dry.

Then you just drop any data that comes in when there’s no pending buffer
rather than hanging 1394.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Wednesday, December 20, 2006 1:23 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object
being paged out?

Hi Dan, Sorry, my misreading of your post - it was the end of a long day

yesterday at this end!

Everyone’s input has helped confirm that a paged out event object is not
the
problem. I just happened to isolate that if I skipped the KeSetEvent()
in
this callback everything works (except of course the app does not see
the
event).

Not clear at the moment why the app responding to the event stops the
isoch
callbacks as it is quite a different thread mostly signalling the user
that
an event has occurred.

My money’s on some delay in KeSetEvent() that is enough to stop further
callbacks (as if a callback is not complete in time for the next it
invariably hangs the 1394 bus driver callback system). I try deferring
the
KeSetEvent().

  • Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 6:27 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object
being
paged out?

I’ll try to be clearer…

A KEVENT object cannot be paged out. That is not your problem.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 11:06 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ObReferenceObjectByHandle - does it stop object
being
paged out?

Thanks - this is based on Oney’s example for signalling the app but it
is
not clear enough that the KeSetEvent will need to be called at
PASSIVE_LEVEL

only in case the event object is paged out.

Interestingly, the event is actually getting signalled - it’s just that
after this the callback stops happening! Before massively reorganising
the
code I’m trying to work out if this is really what the problem is likely
to
be or it it’s just a blind alley for example, does anyone know what
KeSetEvent() is supposed to do if the object is paged out and it is
called
at DISPATCH_LEVEL? I’d have expected a BSOD…

Thanks, Mike

----- Original Message -----
From: Dan Kyler
To: Windows System Software Devs Interest List
Sent: Tuesday, December 19, 2006 5:25 PM
Subject: RE: [ntdev] ObReferenceObjectByHandle - does it stop object
being
paged out?

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event

No, it does not. It gives you a pointer to a kernel mode dispatcher
object,
which just happens to have been created by a call from user mode.

Dispatcher objects (e.g. KEVENTs) are required to be nonpaged. If the
event
was created by a Win32 CreateEvent call, you can bet that it is properly
allocated from nonpaged pool.

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Kemp
Sent: Tuesday, December 19, 2006 10:13 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ObReferenceObjectByHandle - does it stop object being
paged
out?

Hi, I’m using ObReferenceObjectByHandle() to access a user mode event
that
is passed into my driver so I can signal an event.

ntStatus = ObReferenceObjectByHandle(hEvent, EVENT_MODIFY_STATE,
*ExEventObjectType, Irp->RequestorMode, (PVOID*) &pkNotifyAppEvent,
NULL);
…(checking okay here, then)
pDeviceExtension->pNotifyAppEvent = pkNotifyAppEvent;

so that later in a callback handler in the driver I can tell the user
that
something has happened

KeSetEvent(pDeviceExtension->pNotifyAppEvent, EVENT_INCREMENT, FALSE);

My problem is that this seems to work okay until I make the system a bit
busier by increasing data throughput. I don’t get a crash, mainly the
callbacks stop - I’m still investigating.

However I wonder if someone can answer a question for me.

ObReferenceObjectByHandle gets me a kernel mode handle to the user mode
event, and guarantees that the object is not going to be deleted. But
does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Thanks, Mike

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

14

> ObReferenceObjectByHandle gets me a kernel mode handle to the user mode

event, and guarantees that the object is not going to be deleted. But does
it lock it in memory? If not my problem is probably that the callback at
DISPATCH_LEVEL is finding that the event is paged out and that’s it.

Events are never paged out, they are allocated off nonpaged pool.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com