Edit

IrqlIoRtlZwPassive rule (wdm)

  • Article

The IrqlIoRtlZwPassive rule specifies that the driver calls the DDIs listed in the rule only when it is executing at IRQL = PASSIVE_LEVEL.

This rule augments the DDI Compliance Checking IRQL rules for PASSIVE_LEVEL. For more information, see Irql rule set (WDM).

Driver model: WDM

Bug check(s) found with this rule: Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION (0x20023)

Example

The following code violates this rule:

//
// KeAcquireSpinLock raises the IRQL to DISPATCH_LEVEL.
//

KeAcquireSpinLock (&Lock, &OldIrql);

//
// ERROR: IoGetDriverDirectory can only be called at IRQL == PASSIVE_LEVEL.
//

IoGetDriverDirectory (DriverObject,
                      DriverDirectoryData,
                      0,
                      &DirectoryHandle);

KeReleaseSpinLock (&Lock, OldIrql);

For more information about IRQL levels, see Dispatch Routines and IRQLs and Managing Hardware Priorities.

How to test

At compile time

Run Static Driver Verifier and specify the IrqlIoRtlZwPassive rule.

Use the following steps to run an analysis of your code:
  1. Prepare your code (use role type declarations).
  2. Run Static Driver Verifier.
  3. View and analyze the results.

For more information, see Using Static Driver Verifier to Find Defects in Drivers.
At run time

You can activate the DDI Compliance - Additional IRQL rules for one or more drivers by using the Verifier.exe command line. For details, see Selecting Driver Verifier Options. You must restart the computer to activate or deactivate the DDI Compliance - Additional IRQL rules.

At the command line, DDI Compliance - Additional IRQL checking is represented by a rule class value of 35. For example:

verifier /ruleclasses 35 /driver MyDriver.sys

OR

verifier /rc 35 /driver MyDriver.sys

The additional IRQL checking will be active after the PC is rebooted.

Applies to

IoCreateFileEx

IoCreateFileSpecifyDeviceObjectHint

IoGetDeviceDirectory

IoGetDriverDirectory

IoOpenDeviceInterfaceRegistryKey

IoOpenDeviceRegistryKey

RtlCreateRegistryKey

RtlCreateSystemVolumeInformationFolder

RtlWriteRegistryValue

ZwCreateDirectoryObject

ZwCreateFile

ZwCreateKeyTransacted

ZwDeleteFile

ZwDeleteValueKey

ZwFlushBuffersFileEx

ZwFlushBuffersFile

ZwRenameKey

ZwSetEaFile

ZwSetInformationFile

ZwSetInformationKey