Driver Verifier Always Performs Certain Kernel-Mode Driver Tests in Windows 2000

ID: Q229902

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server

SUMMARY

Driver Verifier monitors the selected driver for the following forbidden actions, regardless of which options you choose to monitor.

MORE INFORMATION

Driver Verifier always monitors for the following forbidden actions:

Raising IRQL by calling KeLowerIrql

Lowering IRQL by calling KeRaiseIrql

Requesting a size-zero memory allocation

Allocating or freeing paged pool at an IRQL above APC_LEVEL

Allocating or freeing non-paged pool at an IRQL above DISPATCH_LEVEL

Trying to free an address that was not returned from an allocate call

Trying to free an address that was already freed

Acquiring or releasing a fast mutex at an IRQL above APC_LEVEL

Acquiring or releasing a spin lock at an IRQL other than DISPATCH_LEVEL

Double release of a spin lock

Specifying an illegitimate or random (uninitialized) parameter to any one of several APIs

If Driver Verifier is not active, these violations might not cause an immediate problem in all cases. Driver Verifier monitors the driver's behavior and issues the following bug checks if any of these violations occur:

0xA - IRQL_NOT_LESS_OR_EQUAL

0x50 - PAGE_FAULT_IN_NONPAGED_AREA

0xBE - ATTEMPTED_WRITE_TO_READONLY_MEMORY

0xC1 - SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION

0xC4 - DRIVER_VERIFIER_DETECTED_VIOLATION

0xC6 - DRIVER_CAUGHT_MODIFYING_FREED_POOL

0xC7 - TIMER_OR_DPC_INVALID

0xC9 - DRIVER_VERIFIER_IOMANAGER_VIOLATION

Driver Verifier also checks a driver's unloading after being verified. Driver Verifier performs the following checks to make sure that the driver has cleaned up:

Undeleted timers

Pending DPCs

Undeleted lookaside lists

Undeleted worker threads

Undeleted queues and other similar resources

Problems such as these can potentially cause system bug checks to be issued after the driver unloads, and these bug checks may be hard to explain. When Driver Verifier is active, such violations result in bug check 0xC7 being issued immediately after the driver is unloaded.

For more information please see the Windows 2000 Device Driver Kit (DDK).

For additional information, please see the following article in the Microsoft Knowledge Base:

Q229903 Partial List of Possible Error Codes with Driver Verifier

Additional query words:

Keywords : kbtool ntstop
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo