Edit

IrqlNtifsApcPassive rule (wdm)

  • Article

The IrqlNtifsApcPassive rule specifies that the driver calls the DDIs listed in the rule only when it is executing either at IRQL = PASSIVE_LEVEL or at IRQL <= APC_LEVEL.

Driver model: WDM

Bug check(s) found with this rule: Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION (0x20024)

Example

The following code violates this rule:

//
// KeAcquireSpinLock raises the IRQL to DISPATCH_LEVEL.
//

KeAcquireSpinLock (&Lock, &OldIrql);

//
// ERROR: ZwWriteFile can only be called at IRQL == PASSIVE_LEVEL.
//

ZwWriteFile (Handle,
             NULL,
             NULL,
             NULL,
             IoStatusBlock,
             Buffer,
             BufferLength,
             NULL,
             NULL);

KeReleaseSpinLock (&Lock, OldIrql);

For more information about IRQL levels, see Dispatch Routines and IRQLs and Managing Hardware Priorities.

How to test

At compile time

Run Static Driver Verifier and specify the IrqlNtifsApcPassive rule.

Use the following steps to run an analysis of your code:
  1. Prepare your code (use role type declarations).
  2. Run Static Driver Verifier.
  3. View and analyze the results.

For more information, see Using Static Driver Verifier to Find Defects in Drivers.
At run time

You can activate the DDI Compliance - Additional IRQL rules for one or more drivers by using the Verifier.exe command line. For details, see Selecting Driver Verifier Options. You must restart the computer to activate or deactivate the DDI Compliance - Additional IRQL rules.

At the command line, DDI Compliance - Additional IRQL checking is represented by a rule class value of 35. For example:

verifier /ruleclasses 35 /driver MyDriver.sys

OR

verifier /rc 35 /driver MyDriver.sys

The additional IRQL checking will be active after the PC is rebooted.

Applies to

NtSetInformationFile

NtWriteFile

NtCreateFile

ZwWriteFile

CcCopyWrite

CcCopyWriteEx

CcDeferWrite

CcFastCopyWrite