A Hole In My Head

I have been getting quite a few personal emails with specific questions on how to write a driver or how to a specific technology works or how to fix a particular problem. I welcome the emails, but I want these discussions to be public so that they are...

If you would like me to write about a topic that relates to WDM, the kernel, debugging, WDF, KMDF, UMDF, or anything that I have refered to in other entries, please add a comment to this entry. Comments will be cleared out periodically if there is enough...

I think that the C preprocessor is a very powerful tool, but I like to limit my use of #defines. I have already touched on this when i talked about why I liked FORCEINLINE and I want to talk about it some more. I realize I can't eliminate the use of #defines...

Jake Oshins wanted to write about IRQLs and I am gladly letting him use my blog as a platform. Here it is… I’ve found myself explaining IRQL a lot lately, sometimes to people who want to know because they’re trying to write Windows drivers and sometimes...

For kernel mode code, if I have choice between using a #define or a FORCEINLINE function, the FORCEINLINE function wins every time. #defines have their place, especially for quotifying (the # operator) or concatenating (the ## operator), but they have...

If you look at the docs for many Rtl string functions, you will see that they are callable only at IRQL == PASSIVE_LEVEL. This applies to not only Rtl functions but also to CRT functions Why is that? Well, there are a few resaons The Rtl functions...

The addition of ntintsafe.h for detecting integer overflow/underflow is a great addition to the WDK. It unifies how everyone detects these math errors, leading to common code that anyone can pickup and see what it does...BUT, I have found it does have...

I am not a big fan of the C/C++ preprocessor directives #ifdef or #ifndef . I am not denying that they certainly have their place and usage in the language. I'll first write about where I think they are useful and then about the situations where...

One of the first things I do when I get a new desktop machine or install a new build of Windows is to map the Sleep button on my keyboard to hibernate instead of suspend. Hibernate makes more sense for these machines because they will never run on...

The KMDF model evolved over the entire development cycle. It was refined and refactored multiple times. A lot of WDM abstractions leak through the to the KMDF model. These leaks usually forced their way into the model because without them, KMDF cannot...

One thing that I have always found clunky is stack frame navigation in windbg/kd. Previously, I thought you had only a couple of options. The first option, if you are using WinDBG, is that you can bring up the call stack window. I have found that...

Certain devices are exclusive access, or in simpler terms, only one handle can be opened for a particular device. A serial port is an example of an exclusive device; it would make no sense for 2 applications to have the port open because each would expect...

I think everyone at some point in time wants to embed a break point in there code, whether it be for debugging purposes, path tracing, or detecting edge conditions that have not yet been tested. When I hit a break point, I would prefer that the debugger...

Debugging when your driver fails to load can be exasperating, especially if it is due to a missing import. Windows 2000 would put up a dialog box telling the user which import was missing, but the user can't do anything about it (unless she is the driver...

Have you ever looked at the work item APIs and wondered why there are two different types of work items? Or for that matter, why are there so many work item APIs? As Paul wrote last week, the work item API set has grown for Vista. Today I will try...

There is a hotfix for setupapi.dll, read the KB article http://support.microsoft.com/kb/937187 and see if it applies to your machine

Yesterday I introduced the dl command and demonstrated some of its limitations. Today I will talk about !list . Let's take yesterday's data structure, MY_DATA. What if the LIST_ENTRY is at the end of the structure or there is more data in your structure...

There are a few different possible types of power related buttons on a PC. There is the button on the case itself. If you have a laptop, there is a lid switch to detect state change in the lid. There are also power keys on a keyboard. All of these buttons...

Sometimes your design requires an Interlocked operation that is not currently supported by the OS, runtime libraries, or the compiler (as an intrinsic). You then have a choice to make. Either remove all Interlocked operations for that particular field...

A very common pattern is to allow a caller to ask for the number bytes (or elements) required and then ask for the data, many user mode Win32 APIs (like RegQueryValueEx ) and kernel mode (like IoGetDeviceProperty ) implement it. You first ask for the...

This came up on NTDEV today and has come up in the past (both in the community and internally on the KMDF team). MmIsAddressValid appears to be a great function given its name. You pass in a kernel virtual address (VA from now on) and it returns TRUE...

One of the very cool features of windbg/kd is that you can load any PE file as a dump file. That means that you can load an exe, dll, or sys file as a dump file in the debugger. Your driver won't run ;), but you can look at alot of things in it. All you...

Today I got a callstack via email (from the NTDEV list), but no dump file. I needed to determine if the bugcheck was due to a KMDF or a USB core bug. Since I had no dump file, I had to work purely on what the message contained. The callstack did have...

You might think that just because your device is root enumerated or is plugged into fix slot (llike PCI) and not in a hot plug bus (like USB or PCCARD/PCMCIA) that your driver will not get a IRP_MN_SURPRISE_REMOVAL irp. This would be a bad assumption...

Broadly speaking, there are two (*) types of PIRPs in Windows. By "type" I do not mean the MajorFunction (e.g. IRP_MJ_Xxx) of the PIRP. Rather, a PIRP can be categorized as either threaded or non-threaded. Hopefully I will be able to introduce and clearly...