IrqlIoRtlZwPassive rule (wdm)
The IrqlIoRtlZwPassive rule specifies that the driver calls the DDIs listed in the rule only when it is executing at IRQL = PASSIVE_LEVEL.
This rule augments the DDI Compliance Checking IRQL rules for PASSIVE_LEVEL. For more information, see Irql rule set (WDM).
Driver model: WDM
Bug check(s) found with this rule: Bug Check 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION (0x20023)
The following code violates this rule:
//
// KeAcquireSpinLock raises the IRQL to DISPATCH_LEVEL.
//
KeAcquireSpinLock (&Lock, &OldIrql);
//
// ERROR: IoGetDriverDirectory can only be called at IRQL == PASSIVE_LEVEL.
//
IoGetDriverDirectory (DriverObject,
DriverDirectoryData,
0,
&DirectoryHandle);
KeReleaseSpinLock (&Lock, OldIrql);
For more information about IRQL levels, see Dispatch Routines and IRQLs and Managing Hardware Priorities.
At compile time |
---|
Run Static Driver Verifier and specify the IrqlIoRtlZwPassive rule. Use the following steps to run an analysis of your code:
For more information, see Using Static Driver Verifier to Find Defects in Drivers. |
At run time |
---|
You can activate the DDI Compliance - Additional IRQL rules for one or more drivers by using the Verifier.exe command line. For details, see Selecting Driver Verifier Options. You must restart the computer to activate or deactivate the DDI Compliance - Additional IRQL rules. At the command line, DDI Compliance - Additional IRQL checking is represented by a rule class value of 35. For example:
OR
The additional IRQL checking will be active after the PC is rebooted. |
IoCreateFileEx
IoCreateFileSpecifyDeviceObjectHint
IoGetDeviceDirectory
IoGetDriverDirectory
IoOpenDeviceInterfaceRegistryKey
IoOpenDeviceRegistryKey
RtlCreateRegistryKey
RtlCreateSystemVolumeInformationFolder
RtlWriteRegistryValue
ZwCreateDirectoryObject
ZwCreateFile
ZwCreateKeyTransacted
ZwDeleteFile
ZwDeleteValueKey
ZwFlushBuffersFileEx
ZwFlushBuffersFile
ZwRenameKey
ZwSetEaFile
ZwSetInformationFile
ZwSetInformationKey