It’s late in the day and I’m feeling loquatious. Sorry if I include
information you already know.
-p
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Andrew Nielsen
Sent: Tuesday, August 24, 2004 2:28 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Problems opening and writing to files.
I appologize for all these relatively stupid questions, and
the questions that are probably yet to come. I’m just trying
to learn the easiest way I know; by doing and trial and
error. 2 problems with that method and
Drivers: 1) I don’t know how to debug the damned things and
2) I don’t know what I’m doing.
There are a number of books on the subject of windows device drivers -
you should consider getting one if you haven’t already. Walter Oney has
a good one on WDM drivers that should cover some of these basics and
then some. You might also want to pickup a copy of Inside Windows 2000
for some more information about the system internals.
Now for a, probably, really stupid question. I used
KeRaiseIrql(blah) and then I called KeGetCurrentIrql() and it
returned PASSIVE_LEVEL. Is that a fluke or is it just simply
because I called KeRaiseIrql and that was a catalyst of a
major crash and burn?
Passive level is the lowest interrupt level - basically it means the
processor is running whatever the thread was running when it started up.
This could be user-mode code if it’s part of a user-mode process, or it
could be kernel mode code if the thread is part of the “system process”
or if the app called into the kernel.
It’s actually legal to raise to the same IRQL you’re already at. If
your thread was already at passive level then this would work just fine.
However it is NOT legal to change to a lower IRQL arbitrarily - you can
only do this if you’re the one who raised IRQL in the first place. So
if you were running code in an ISR or a DPC routine (which run at >
PASSIVE_LEVEL) and tried to raise to passive level, it would be bad
(bugcheck, odd corruption, hung system, etc…)
And the questions get stupider and stupider… lol
I know what Threads are, and have used them extensively in
General Windows programming, and since I’m in a whole knew
territory, I have to ask. Is there a difference between what
I know to be a thread, and what you call a “worker thread”?
A worker thread is just a thread dedicated to doing small bits of work
for other threads. There’s nothing magical about it - it’s a normal
thread which runs some code that watches a queue of work item packets.
Drivers enqueue entries into this queue using the appropriate Ex or Io
work item routines and the worker threads pick these up and invoke the
callback stored in the packet.
This is something your driver can do itself too. You can create your
own system thread (though you typically don’t want to do this - threads
are sort of expensive) and arrange for it to do work for you in a
variety of ways.
The reason worker threads are important to drivers has to do with IRQL
levels and “context” - which are sort of related. Drivers are event
driven - some kernel-component calls them whenever it needs them to do
some sort of work. This might be the I/O manager telling it that
there’s an I/O packet to process, it might be the kernel/hal telling it
that an interrupt has occurred, or it might be a callback that the
driver setup - telling it that a timer has expired or that a DPC can now
run.
These callbacks run in an “arbitrary thread context”. Sometimes it’s an
appropriate one - like the thread of an application that’s sending I/O
to your driver. Sometimes it’s at raised IRQL, or in some other thread
(for various odd reasons - there are rules to when this will happen).
If your driver must run something in a non-arbitrary context (basically
in a thread it owns) then it either needs its own worker thread, or it
needs to queue a work item and use one of the system worker threads.
I just took a quick look through the DDK Samples, and I
didn’t find anything(in what I checked) that showed how to
work with files in a Driver Environment. That, in turn is
how I learn fastest. I see, I copy and I make my own then
retain for future use.
If you can help it you don’t want to be working with files in a driver
environment. If you need data from a file, you’re often better off
having an application that opens the file and feeds your driver the
data. This way you don’t have as much risk of getting tricked into
opening a file that a user might otherwise not be able to access (and
this is actually a bad thing to do, even if you think it’s part of your
design).
I know I’m mixing replies, but…
“This is also why I tell people to use checked build,
verifier and CUV you call would have been flagged.”
What do you mean by verifier and CUV? Please bare in mind
I’m new to this and try to keep the insults to a minimum. 
Driver verifier is a set of additional validation that the kernel can
apply to your driver. Run verifier.exe from the command line when
you’re logged in. These tests can slow the system down, but they should
be on during development.
Of course once you have these tests turned on it will be pretty
important that you have a debugger attached. In fact before you even
bother writing your own driver, you might want to grab the toaster
driver samples, compile & install them, and then just practice debugging
them with windbg until you’ve got the basics down. It will save you a
lot of pain in the future if you learn to debug before it’s a critical
thing.
P.S. If anyone is willing to directly help me(e-mail to
e-mail) and keep this a little cleaner, that’d be GREATLY appreciated.
Thanks in advance.
Andrew
From: “Roddy, Mark”
> Reply-To: “Windows System Software Devs Interest List”
>
> To: “Windows System Software Devs Interest List”
> Subject: RE: [ntdev] Problems opening and writing to files.
> Date: Tue, 24 Aug 2004 16:16:16 -0400
>
> Er, no. In general you cannot just set yourself to
> PASSIVE_LEVEL, you have to actually be at PASSIVE_LEVEL. It
> is perhaps NEVER achieved by KeRaiseIrql(PASSIVE_LEVEL,
> &temp);. It is generally achieved by queuing a worker thread
> that will then run at PASSIVE_LEVEL legitimately.
>
>
>
>
> =====================
> Mark Roddy
>
> -----Original Message-----
> From: Andrew Nielsen [mailto:xxxxx@hotmail.com]
> Sent: Tuesday, August 24, 2004 4:06 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Problems opening and writing to files.
>
> I use ZwCreateFile/ZwWriteFile/ZwClose and I know that IRQL
> is supposed to be PASSIVE_LEVEL, and that’s generally
> achieved by; KeRaiseIrql(PASSIVE_LEVEL, &temp). My problem,
> is the computer just simply restarts everytime I go to either
> ZwCreateFile or ZwWriteFile. Should I maybe use something
> other than the ZwXxx functions? Or should I not bother with
> File Manipulation at all?
>
> Regards,
> Andrew
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@stratus.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@hotmail.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@windows.microsoft.com To unsubscribe send a blank
> email to xxxxx@lists.osr.com
>