Timer objects and KeCancelTimer

NTDEV
1

We are in the process of debugging a blue screen under Windows 2000, which
seems related to timer functions. The blue screen parameters are derived as
a result of running Driver Verifier, with the bugcheck being 0xC7:
TIMER_OR_DPC_INVALID. The 2 questions I have are:

  1. Can a KTIMER object be declared off of the stack? The DDK documentation
    indicates that KTIMER objects must be allocated from Non-paged memory, yet I
    have found examples in the DDK that seem to be declaring KTIMER objects on
    the stack.

  2. Do all timers have to be terminated with KeCancelTimer(), even if they
    are already expired? The code that I have inherited does not always call
    KeCancelTimer(), and in those cases where it doesn’t, I’m able to use Driver
    Verifier to cause a blue screen (even without driver verifier, I can get a
    blue screen…it’s just that the bug check data is less descriptive.) What
    I’ve found is that calling KeCancelTimer() on all timers, even those that
    have expire, alleviates the blue screen. However, I cannot find any DDK
    documentation which supports this coding convention.

Thanks in advance…

Joe Rotella
Tektronix Optical Test
xxxxx@tektronix.com
(978)244-4338

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

The stack of a kernel routine will be non-paged (not subject, in other
words, to piecemeal page-stealing). There is, however, the possibility
that the process of a dispatch routine would be “swapped” out, en masse,
if the dispatch routine is in a wait. To prevent such a consequence, use
the KernelMode parameter).

I’ve not used timer cancellation, but I’d be surprised if it were
necessary, or even permissible (in check build at least), to cancel an
expired timer object.

–
James Antognini
IBM Watson Research

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

You could allocate a timer object in the stack but you need to make
sure:

  1. You don’t leave the function until the timer has fired/expired.

  2. If you wait on the timer or some other dispatcher object, you must do
    a Kernel-mode wait to prevent the stack from being paged out.
    KeWaitForSingleObject(Timer, Executive, KernelMode, FALSE,
    NULL);

  3. If you are absolutely sure that the timer has expired, you don’t have
    to call KeCancelTimer. The return value of KeCancelTimer tells you
    whether the timer is cancelled or not.

-Eliyas

-----Original Message-----
From: xxxxx@exgate.tek.com
[mailto:xxxxx@exgate.tek.com]
Sent: Friday, May 25, 2001 7:49 AM
To: NT Developers Interest List
Subject: [ntdev] Timer objects and KeCancelTimer

We are in the process of debugging a blue screen under Windows 2000,
which
seems related to timer functions. The blue screen parameters are
derived as
a result of running Driver Verifier, with the bugcheck being 0xC7:
TIMER_OR_DPC_INVALID. The 2 questions I have are:

  1. Can a KTIMER object be declared off of the stack? The DDK
    documentation
    indicates that KTIMER objects must be allocated from Non-paged memory,
    yet I
    have found examples in the DDK that seem to be declaring KTIMER objects
    on
    the stack.

  2. Do all timers have to be terminated with KeCancelTimer(), even if
    they
    are already expired? The code that I have inherited does not always
    call
    KeCancelTimer(), and in those cases where it doesn’t, I’m able to use
    Driver
    Verifier to cause a blue screen (even without driver verifier, I can get
    a
    blue screen…it’s just that the bug check data is less descriptive.)
    What
    I’ve found is that calling KeCancelTimer() on all timers, even those
    that
    have expire, alleviates the blue screen. However, I cannot find any DDK
    documentation which supports this coding convention.

Thanks in advance…

Joe Rotella
Tektronix Optical Test
xxxxx@tektronix.com
(978)244-4338

You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Thanks for the info. I appreciate the data on the KernelMode flag, as this
will be a spot to check for trouble.

Thanks again.

Joe

-----Original Message-----
From: Eliyas Yakub [mailto:xxxxx@microsoft.com]
Sent: Friday, May 25, 2001 2:18 PM
To: NT Developers Interest List
Subject: [ntdev] RE: Timer objects and KeCancelTimer

You could allocate a timer object in the stack but you need to make
sure:

  1. You don’t leave the function until the timer has fired/expired.

  2. If you wait on the timer or some other dispatcher object, you must do
    a Kernel-mode wait to prevent the stack from being paged out.
    KeWaitForSingleObject(Timer, Executive, KernelMode, FALSE,
    NULL);

  3. If you are absolutely sure that the timer has expired, you don’t have
    to call KeCancelTimer. The return value of KeCancelTimer tells you
    whether the timer is cancelled or not.

-Eliyas

-----Original Message-----
From: xxxxx@exgate.tek.com
[mailto:xxxxx@exgate.tek.com]
Sent: Friday, May 25, 2001 7:49 AM
To: NT Developers Interest List
Subject: [ntdev] Timer objects and KeCancelTimer

We are in the process of debugging a blue screen under Windows 2000,
which
seems related to timer functions. The blue screen parameters are
derived as
a result of running Driver Verifier, with the bugcheck being 0xC7:
TIMER_OR_DPC_INVALID. The 2 questions I have are:

  1. Can a KTIMER object be declared off of the stack? The DDK
    documentation
    indicates that KTIMER objects must be allocated from Non-paged memory,
    yet I
    have found examples in the DDK that seem to be declaring KTIMER objects
    on
    the stack.

  2. Do all timers have to be terminated with KeCancelTimer(), even if
    they
    are already expired? The code that I have inherited does not always
    call
    KeCancelTimer(), and in those cases where it doesn’t, I’m able to use
    Driver
    Verifier to cause a blue screen (even without driver verifier, I can get
    a
    blue screen…it’s just that the bug check data is less descriptive.)
    What
    I’ve found is that calling KeCancelTimer() on all timers, even those
    that
    have expire, alleviates the blue screen. However, I cannot find any DDK
    documentation which supports this coding convention.

Thanks in advance…

Joe Rotella
Tektronix Optical Test
xxxxx@tektronix.com
(978)244-4338

You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: xxxxx@tektronix.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com