OSR Dev Blog

Beware of KeAcquireSpinLockRaiseToSynch(...)!
(By: Hector J. Rodriguez | Published: 15-Oct-02| Modified: 10-Oct-02)

Starting with Windows 2000®, the NTDDK.H included the definition of a function named KeAcquireSpinLockRaiseToSynch(?). This function was never documented in the DDK documentation, and (quite frankly) was probably exposed unintentionally.

What made this function particularly interesting was that in Win2K, SYNCH_LEVEL was defined as IPI_LEVEL-1, which is at least as high as the highest device IRQL.  Thus, I've seen developers who use this function as the equivalent of "KeAcquire A Spin Lock That's At Least As High As the highest DIRQL."

This is a Very Bad Idea.

IRQL SYNCH_LEVEL was never intended to be equal to "at least as high as the highest DIRQL."  Thus, in Windows XP®, you can see SYNCH_LEVEL was changed as follows:

#if defined(NT_UP)

    #define SYNCH_LEVEL DISPATCH_LEVEL // synchronization level - UP system


    #define SYNCH_LEVEL (IPI_LEVEL-2) // synchronization level - MP system


I'm thinkin' that if you intended KeAcquireSpinLockRaiseToSynch(?) to raise to at least the highest DIRQL, the definition of SYNCH_LEVEL in Windows XP would mean that you're in big trouble.  Your driver would work correctly on Win2K and potentially hang on Windows XP.

So, in short, if you use this function in your driver remove it ASAP.  I wouldn't be at all surprised if Microsoft removed this prototype entirely from the Windows .NET DDK.

This article was printed from OSR Online http://www.osronline.com

Copyright 2017 OSR Open Systems Resources, Inc.