Drivererror
Harald
My situation is that I implemented a wdm driver which communicates with over
the TDI Interface with the networkcontroller to send UDP packages and with an
other driver to get and send messages with IRPs. My driver allocates all used
memory in the DriverEntry. The whole system works fine but I see that the
system cache increases really fast and then he stops increasing. Thats not
the big problem but after one or two hours i got an BlueScreen from the
networkcarddriver or from the other driver with the following error message:
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
Know I know that the error results from my driver because the system without
my driver works fine. Is it possible that I get to many memory and so the
other driver are not able to get any more memory or is there another problem?
The system works on an Windows server 2003 with an Xeon CPU and 2Gb Ram.
If anybody has an advice what I can do to avoid this error please write it
in the forum. THANKS
Harald
Maxim S. Shatskih
--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com
"Harald" <Har...@discussions.microsoft.com> wrote in message news:C72DCD49-422F-4571...@microsoft.com...
Harald
memory leak that the event 2020 or 2019 is in the Eventlo of the system?! But
I didn't found these Events in my Systemlog. Is this an indication that ther
is no memory leak in my driver?!
If there is no memory leak where can i search for another error?
Harald
"Harald" wrote:
> So you also think that there is an memoryproblem in my driver or?
Harald
Maxim S. Shatskih
--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com
"Harald" <Har...@discussions.microsoft.com> wrote in message news:386C4C63-A0C8-4A6C...@microsoft.com...
Harald
I startet mydriver with the poolmon running and I used
ExAllocatePoolWithTag. When I start the driver I have a difference between
alloc and free of 1003 and when I stop the drive i have difference 0. During
the run the difference increase when I open an driver intern session but it
also decrease when I close the driverintern session. The Irps which are
allocated with IoAllocateIrp are with the Tag IRP or? This value is stable.
What can I do now the find an potential leak?
Harald
Maxim S. Shatskih
> alloc and free of 1003
On what tag?
Harald
away because he free memory in the unloadfunction.
Maxim S. Shatskih
--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com
"Harald" <Har...@discussions.microsoft.com> wrote in message news:93700F18-6D8A-42FB...@microsoft.com...
Harald
driverextension are also semaphores and mutex. Then I have 4 Workingthreads
and every thread has an IRP which is used to send data to an other driver.
The Irps will be reused.
So i only use ExAllocatePoolWithTag and ExFreePoll and IoAllocateIrp and
IoFreeIrp.
Harald
Harald
the Networkcard that it should use QoS. When using such an irp the lowerlevel
driver must call IoCompleteRequest to free the Irp. Can i trust the
networkdriver that he will call this function and must i also call IoFreeIrp?!
Harald
Volodymyr Shcherbyna
"IRPs that are created by IoBuildDeviceIoControlRequest must be completed by
a driver's call to IoCompleteRequest. A driver that calls
IoBuildDeviceIoControlRequest must not call IoFreeIrp, because the I/O
manager frees these synchronous IRPs after IoCompleteRequest has been
called."
So you definitly should not call IoFreeIrp unless you want to cause one more
BSOD. Regarding your problem, try to run your code under verifier with all
checks, when driver is unloaded, it checks for pending deallocations and
asserts with BSOD if driver has not released some memory.
But if you tag all memory (make sure this is really the case, each memory
allocation should be tagged) you can watch the statistics when system starts
to slow down. If OS is slowing down, and your tag allocations are not
depicted in poolmon as increasing, than pay attention to another tag
statistics.
--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:7D835F08-FB70-40B5...@microsoft.com...
Maxim S. Shatskih
Just use globals instead.
--
Maxim S. Shatskih
Windows DDK MVP
ma...@storagecraft.com
http://www.storagecraft.com
"Harald" <Har...@discussions.microsoft.com> wrote in message news:1BE9B191-0ED1-416A...@microsoft.com...
Harald
@Maxim: I use the driverstudio framework for the driver and there is an
class with the device and the device consists of the memory for the buffers,
the Events and the semaphore. And i have an global variable which point to
the instance of the class.
@Volodymyr: I tried the verifier with all options for my driver. THe start
of the driver works but when the usermoderprogram shich communicates with my
driver send an iocall i got an BSOD with BadPoolCaller. Is this a problem of
the verifier or of my driver?
Thanks for your help!!!!!
Maxim S. Shatskih
Very bad framework full of bugs, throw it away and move to KMDF or to bare WDM.
> @Volodymyr: I tried the verifier with all options for my driver. THe start
> of the driver works but when the usermoderprogram shich communicates with my
> driver send an iocall i got an BSOD with BadPoolCaller. Is this a problem of
> the verifier or of my driver?
Probably of DriverStidio.
Harald
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to
set symbol path and load symbols.
FAULTING_MODULE: 80800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a13b98f
BUGCHECK_STR: 0xc2_9b
DEFAULT_BUCKET_ID: DRIVER_FAULT
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 809b6e5b to 80827c83
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
adef184c 809b6e5b 000000c2 0000009b 00000000 nt!KeBugCheckEx+0x1b
adef1870 809b7594 00000000 00000014 00000000 nt!RtlCompressBuffer+0x4e09
adef1894 ad5e1361 00000000 00000014 00000000 nt!RtlCompressBuffer+0x5542
adef18ac ad5e1302 88f3c618 88f3c618 adef18c8
ITCTECCTI!ExAllocateFromNPagedLookasideList+0x51 [c:\program
files\compuware\driverstudio\drivernetworks\include\ntddk.h @ 12732]
adef18bc ad5e11fe adef18c4 adef1918 ad5dfe6c
ITCTECCTI!KNdisHeap<KTdiClient::TDI_REQCXT>::alloc+0x12 [c:\program
files\compuware\driverstudio\drivernetworks\include\kndisheap.h @ 310]
adef18c8 ad5dfe6c 00000010 88f3c618 00000000
ITCTECCTI!KNdisHeapClient<KTdiClient::TDI_REQCXT>::operator new+0xe
[c:\program files\compuware\driverstudio\drivernetworks\include\kndisheap.h @
145]
adef1918 ad5c5d30 adef1955 8990e4fc 00000014
ITCTECCTI!KDatagramSocket::sendto+0x2c [c:\program
files\compuware\driverstudio\drivernetworks\source\tdiclient\tdidtgsocket.cpp
@ 114]
adef1974 ad5d484e c0a802ef 8990ce71 8990e4fc
ITCTECCTI!UDPReceiveSession::SendPacket+0x70 [c:\itcteccti\itcteccti mit rtp
new\driver\itctecctiudpconnection.cpp @ 269]
adef19c4 ad5cd8bc 82ff9028 00000004 82ff90e0
ITCTECCTI!ITCTECCTIRtpSession::stop+0x18e [c:\itcteccti\itcteccti mit rtp
new\driver\itctecctirtpsession.cpp @ 325]
adef1b78 ad5d9960 8a788f00 ffffffff adef1bbc
ITCTECCTI!ITCTECCTIDevice::DeviceControl+0xc1c [c:\itcteccti\itcteccti mit
rtp new\driver\itctecctidevice.cpp @ 810]
adef1bb0 ad5c67f7 8a788f00 80a5ff00 82ff9028
ITCTECCTI!KPnpDevice::DeviceIrpDispatch+0x420 [c:\program
files\compuware\driverstudio\driverworks\source\kpnpdev.cpp @ 497]
adef1bc4 809b550c 82ff9028 8a788f00 8a788fd4
ITCTECCTI!KDriver::DriverIrpDispatch+0x57 [c:\program
files\compuware\driverstudio\driverworks\include\kdriver.h @ 965]
adef1bf4 8081df53 809c560e adef1c14 809c560e nt!RtlCompressBuffer+0x34ba
adef1c00 809c560e 80a5ff00 88368f08 00000000 nt!IofCallDriver+0x13
adef1c14 809b550c 88368f08 8a788f00 8a788f00 nt!RtlCompressBuffer+0x135bc
adef1c44 8081df53 808f5437 adef1c64 808f5437 nt!RtlCompressBuffer+0x34ba
adef1c50 808f5437 8a788fdc 86e84f28 8a788f00 nt!IofCallDriver+0x13
adef1c64 808f61bf 88368f08 8a788f00 86e84f28 nt!NtWriteFile+0x2943
adef1d00 808eed08 00000354 00000000 00000000 nt!NtWriteFile+0x36cb
adef1d34 808897bc 00000354 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
adef1d64 7c8285ec badb0d00 0345f36c 00000000
nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb64
adef1d68 badb0d00 0345f36c 00000000 00000000 0x7c8285ec
adef1d6c 0345f36c 00000000 00000000 00000000 0xbadb0d00
adef1d70 00000000 00000000 00000000 00000000 0x345f36c
STACK_COMMAND: kb
FOLLOWUP_IP:
ITCTECCTI!ExAllocateFromNPagedLookasideList+51 [c:\program
files\compuware\driverstudio\drivernetworks\include\ntddk.h @ 12732]
ad5e1361 8945fc mov dword ptr [ebp-4],eax
FAULTING_SOURCE_CODE:
No source found for 'c:\program
files\compuware\driverstudio\drivernetworks\include\ntddk.h'
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: ITCTECCTI!ExAllocateFromNPagedLookasideList+51
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ITCTECCTI
IMAGE_NAME: ITCTECCTI.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
I dont get an BSOD when the verifier is not running!?
Volodymyr Shcherbyna
> of the driver works but when the usermoderprogram shich communicates with
> my
> driver send an iocall i got an BSOD with BadPoolCaller. Is this a problem
> of
> the verifier or of my driver?
In 99.(9)% of the cases this is the problem of your driver. Analyze your
code, if you got BadPoolCaller usually means you allocated x bytes, but
written x+1 or simular.
--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:6061418A-F675-4835...@microsoft.com...
Maxim S. Shatskih
Driver Verifier helps a lot for this.
Harald
memorydumo is the SYMBOL_NAME: ITCTECCTI!ExAllocateFromNPagedLookasideList+51
from below.
When i start it without the verifier it works for some time and then i get
an bsod during an iocalldriver to the networkcarddriver.
Volodymyr Shcherbyna
Check your code. Normally, you should do intensive checks with verifier
before releasing driver to public. That is what your QA engineer should be
aware of. Also, you (or QA) should perform the following checks:
- staticdrv checks (they can find out the actually problem why you have bad
pool header)
- verifier checks (with all checks, I do stress tests for weeks in 2k, XP,
Vista, 2k03, 2k08 real machines before releasing to public)
- kernrate checks (to see weak places in code in terms of perfomance)
- DTM tests (usefull as well)
So, that fact that it does not fail without verifier does not mean your code
is OK :)
--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:98BA5F51-14F3-4896...@microsoft.com...
Volodymyr Shcherbyna
Nope. Originally, you have appeared at this newsgroup trying to solve
problem of memory leaks. It could be the outcome of a bug related to memory
management which is being tracked down by driver verifier. The good thing
about driver verifier is that it finds out the problems, not the symptoms.
So get your code fixed, and it should pass verifier tests for days and
weeks!
Harald
in the memory dump are often in files from the driverstudio.
Pavel A.
_supported_ solution ASAP. Unsupported means just that - you need help,
but can't get any.
Good luck.
-- pa
Volodymyr Shcherbyna
Use pure WDK and thus control all the code (even if it is painful).
Otherwise what options do you have? Ignore the problem? Does not seems a
good idea for me.
--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:93CC33A8-D859-4FE8...@microsoft.com...
Harald
first driver and i had no know how so i used it. Know it is impossible to
write the driver without it bevause the time is not available.
Don Burn
if you think debugging and working around all of these plus probably 10
times that amount that are not known, is faster than rewriting the driver
with a stable environment, then all I can say is good luck. I have never
seen an effort lately to use DriverStudio that did not in the end throw it
out, after wasting many times what it would have taken to use something like
KMDF in the first place.
--
Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:B04D411B-98D9-4CE3...@microsoft.com...
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 4091 (20090520) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature database 4091 (20090520) __________
The message was checked by ESET NOD32 Antivirus.
Alberto
Harald,
If I was looking for a memory leak, I would add a priority queue
implementation to the driver (you can suck one up from your favorite
algorithms book, such as CLR for example, and get it up and working in
a few minutes). I would then create a little record for each piece of
memory I allocate - obviously in a non-dynamic area, for example, in a
global array of little structures or in such an array stored in a
device extension, or in a preallocated buffer set up at driver start
time - and I would enqueue one such little item into the priority
queue every time I allocate memory, using the memory address as key.
When I free the storage I would remove the item from the priority
queue. At key points such as close, unload or shutdown, I would
traverse the priority queue, log the fact that there's memory still
allocated, and then I would free the memory.
If you want to walk the extra mile, you can add an Ioctl to your
driver to expose that priority queue to the user, which allows you to
write a "top" style tool (like the Unix "top" utility) that shows you
what's going on with your buffer allocations.
This may not pinpoint a leak inside a DriverStudio library, but it
will show whether the leak is in your own code. You can also consider
overriding "new" and "delete" with your own code, where you can plugin
in this priority queue mechanism and see if you detect a possible leak
inside the class library.
Hope this helps, if not, toss it.
Alberto.
On May 20, 9:58 am, "Volodymyr Shcherbyna"
> > in the memory dump are often in files from the driverstudio.- Hide quoted text -
>
> - Show quoted text -
Harald
I am also for writing the driver new but I have some objections. For example
the communication with the network was very easy with the driverstudio. It
works with tdi. Thats the only part of the driver which is not so easy to
replace. The reading fom the registry, the threads, mutex, irp system is not
so complex to write new in wdm or?
I also looked at the kmdf. Is this near to driverstudio from the work?!
Don Burn
http://www.pcausa.com/tdisamp/default.htm This is a set of advanced
examples that can be taken and made to do almost anything one wants with
TDI. The price of these samples can be made up very quickly in the speed of
getting a driver developed. Also, be aware that for later systems such as
Vista there is a kernel sockets support.
As far as KMDF no it is not like Driver Studio, it is a model for driver
writing that handles much of the complexity of the driver for you, and has
the advantage of being supported by Microsoft and they are using it for many
standard drivers in the kernel.
--
Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:F554B6D1-8CDF-463F...@microsoft.com...
Maxim S. Shatskih
> first driver and i had no know how so i used it. Know it is impossible to
> write the driver without it bevause the time is not available.
Buggy framework saves you the coding time but increases the bugfixing time a lot.
Harald
also for Windows server 2008.
No I have a question. My driver only communicat with an usermode program and
with an other driver. Can I use the communication as same as in the
driverstudio with irps or must i change there anything?
Harald
Don Burn
the nasty details of PnP, power and cancel for your IRP's.
--
Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
"Harald" <Har...@discussions.microsoft.com> wrote in message
news:A2A83D66-0779-4E9D...@microsoft.com...
> __________ Information from ESET NOD32 Antivirus, version of virus
> signature database 4100 (20090525) __________
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
__________ Information from ESET NOD32 Antivirus, version of virus signature database 4100 (20090525) __________