Write to file on an interrupt

How can I write to file if my interrupt function is fired? I know can't write
to file from an interrupt function because it's running at DIRQL. What's the
way around?

This is what I want to do:

Whenever an interrupt is fired, I want to log the event to a file in my own
format (for debugging and testing purposes).

If I use dedicated thread which will perform write operations at
PASSIVE_LEVEL, then following problem can arise:

While dedicated thread is reading from a dedicated non-paged memory, it may
get interrupted again by the same interrupt. Interrupt routine can then
overwrite data in dedicated memory. When thread execution is restored it
could end-up writing inconsistent data in the file, that is data from 2nd
interrupt rather than 1st.

If KeSynchronizeInterrupt routiune is used to synchronise read/write
operation, thread IRQL will raise to DISPATCH_LEVEL, but that would cause
another problem becasue file operations can't be performed at DISPATCH_LEVEL.

More help required


"x64" wrote:

> > How can I write to file if my interrupt function is fired? I know can't write
> > to file from an interrupt function because it's running at DIRQL. What's the
> > way around?
>
> Use dedicated thread in conjunction with non-paged buffer for data
> which you want to write.
> .
>

Mohit Gupta <> wrote:
>
>How can I write to file if my interrupt function is fired? I know can't write
>to file from an interrupt function because it's running at DIRQL. What's the
>way around?
>
>This is what I want to do:
>
>Whenever an interrupt is fired, I want to log the event to a file in my own
>format (for debugging and testing purposes).

The RIGHT way to do this is to use KdPrint or DbgPrint to send the message
to the kernel debug buffer. Then, you can use the DebugView tool to
capture the messages to memory or log them to file.
--
Tim Roberts,
Providenza & Boekelheide, Inc.

Thanks Tim.

KdPrint or DbgPrint is definitely a better option, however, my requirement
at this moment is to write it to file


"Tim Roberts" wrote:

> Mohit Gupta <> wrote:
> >
> >How can I write to file if my interrupt function is fired? I know can't write
> >to file from an interrupt function because it's running at DIRQL. What's the
> >way around?
> >
> >This is what I want to do:
> >
> >Whenever an interrupt is fired, I want to log the event to a file in my own
> >format (for debugging and testing purposes).
>
> The RIGHT way to do this is to use KdPrint or DbgPrint to send the message
> to the kernel debug buffer. Then, you can use the DebugView tool to
> capture the messages to memory or log them to file.
> --
> Tim Roberts,
> Providenza & Boekelheide, Inc.
> .
>

Hi,

On 2010年06月16日 05:44, Mohit Gupta wrote:

> While dedicated thread is reading from a dedicated non-paged memory, itmay
> get interrupted again by the same interrupt. Interrupt routine can then
> overwrite data in dedicated memory.

So use a buffer that has an appropriate amount of space for several entries.

If the buffer ever gets full, events will be lost, there is no way to
avoid that.

Simon

a better option would be to use ETW. you fire the ETW event from your
DPCForIsr and then your user mode application can listen for the ETW event
and react any way it wants to it (log to a file, log to memory, send it over
the network)

d

"Mohit Gupta" wrote in message
news:8081FC51-E3A2-4230-ABF5-...

Thanks Tim.

KdPrint or DbgPrint is definitely a better option, however, my requirement
at this moment is to write it to file


"Tim Roberts" wrote:

> Mohit Gupta <> wrote:
> >
> >How can I write to file if my interrupt function is fired? I know can't
> >write
> >to file from an interrupt function because it's running at DIRQL. What's
> >the
> >way around?
> >
> >This is what I want to do:
> >
> >Whenever an interrupt is fired, I want to log the event to a file in my
> >own
> >format (for debugging and testing purposes).
>
> The RIGHT way to do this is to use KdPrint or DbgPrint to send the message
> to the kernel debug buffer. Then, you can use the DebugView tool to
> capture the messages to memory or log them to file.
> --
> Tim Roberts,
> Providenza & Boekelheide, Inc.
> .
>

Mohit Gupta <> wrote:
>
>KdPrint or DbgPrint is definitely a better option, however, my requirement
>at this moment is to write it to file

DebugView can write the DbgPrint logs to file. Use the tools that are at
your disposal.
--
Tim Roberts,
Providenza & Boekelheide, Inc.