DRIVER_IRQL_NOT_LESS_OR_EQUAL on Win7 x64

[rohaaan]

After cross compiling windows driver on linux and loading it in windows, when user mode app is run Driver crashes with BUG_CHECK 0xD1 : DRIVER_IRQL_NOT_LESS_OR_EQUAL

[asamy]

Thanks but it'd be appreciated if you followed the Issue template and at least uploaded the files required along with any patches applied (i.e. source code or Makefile edits.).

[rohaaan]

it'd be appreciated if you followed the Issue template
Yes, I will.

at least uploaded the files required along with any patches applied (i.e. source code or Makefile edits.).
No patchwork.
Procedure to reproduce the crash:

1. Cross compile ksm.sys on Ubuntu Linux 14.04 64bit for windows.
2. Copy ksm.sys to windows 7 pro 64 bit and register the service as ksm.
3. Restart and turn off driver signing enforcement during windows boot since driver signing failed.
4. Load the driver.
5. Run the a.exe produced.

[rohaaan]

Tried once again... Result is same, crash. This time one change in Makefile.windows,
Line 41: WINVER ?= 0x0601

[asamy]

The issue template clearly says if it's a crash you need to upload .dmp files, and the produced executable file, .sys file, etc.

[rohaaan]

Hi,

Please check attachment

hypervisor.zip

[asamy]

Can you try without -DENABLE_PRINT? I kind of suspect the print interface had some nasty changes so that might be it. Also, if you wouldn't mind (and have the resources to do so), try out the build generated by appveyor builds (Windows 10 only!), and see if it crashes too.

[rohaaan]

I have no windows 10 installation. I will get one and try asap... :)

[rohaaan]

try without -DENABLE_PRINT
Tried... no success. Also above variable is for linux build.
next I modified Makefile.windows and disabled -DENABLE_DBGPRINT
still crashing

[asamy]

I wonder if it's an optimization related issue, since I was always compiling without optimizations when testing the cross build and they all worked fine (except on cross win10 builds), so I'd also try disabling that too. Last time I tested it was working fine with both native win32 (NOT MinGW, but CL), and Linux builds, so I suspect it's some option that's passed to GCC messes it up or just something to do with initialization code that the NT kernel does not like, in either case, from the generated disassembly, I see nothing obvious that hints on it.

I'll look into the DMP file soon, though. I took a quick peek at it and the checksum did not match[?] . Not sure.

[rohaaan]

I have discovered, that crash happens in DriverDispatch's switch case case KSM_IOCTL_SUBVERT:

[asamy]

The real question is, which path it ends up in. What I'd appreciate is, if you use GDB to debug the kernel (If you're using QEMU/VMWare, it's quite easy), then it'd be really easy to find it.

The DriverDispatch() path (with that ioctl) is basically, ksm_subvert() -> vcpu_init() -> vmlaunch -> do_resume.

[rohaaan]

ksm_subvert -> __ksm_init_cpu
__ksm_init_cpu is run as dpc.
now the crash occurs because the code from within __ksm_init_cpu calls inline functions that could be paged out.

I am reviewing the code. Please make a review from your end too.