Windows kernel macros
- 24 minutes to read
-
Contributors
The following table contains Windows kernel macros:
| Macro | Declared in | Description |
|---|---|---|
| ADDRESS_AND_SIZE_TO_SPAN_PAGES | Wdm.h |
The ADDRESS_AND_SIZE_TO_SPAN_PAGES macro returns the number of pages spanned by the virtual range defined by a virtual address and the size in bytes of a transfer request. Va [in] PVOID Pointer to the virtual address that is the base of the range. Size [in] ULONG Specifies the size in bytes of the transfer request. Return value ULONG ADDRESS_AND_SIZE_TO_SPAN_PAGES returns the number of pages spanned by the virtual range starting at Va. Drivers that make DMA transfers call ADDRESS_AND_SIZE_TO_SPAN_PAGES to determine whether a transfer request must be split into a sequence of device DMA operations. A driver can use the system-defined constant PAGE_SIZE to determine whether the number of bytes to be transferred is less than the virtual memory page size of the current platform. Callers of ADDRESS_AND_SIZE_TO_SPAN_PAGES can be running at any IRQL. The caller must ensure that the specified parameters do not cause memory overflow. Available starting with Windows 2000. |
| BYTE_OFFSET | Wdm.h |
The BYTE_OFFSET macro takes a virtual address and returns the byte offset of that address within the page. Va [in] PVOID Pointer to the virtual address. Return value ULONG BYTE_OFFSET returns the offset portion of the virtual address. Available starting with Windows 2000. IRQL: Any level |
| BYTES_TO_PAGES | Wdm.h |
The BYTES_TO_PAGES macro takes the size in bytes of the transfer request and calculates the number of pages required to contain the bytes. Size [in] ULONG Specifies the size in bytes of the transfer request. Return value ULONG BYTES_TO_PAGES returns the number of pages required to contain the specified number of bytes. The system-defined constant PAGE_SIZE can be used to determine whether a given length in bytes for a transfer is less than the virtual memory page size of the current platform. Available starting with Windows 2000. IRQL: Any level |
| CONTAINING_RECORD | Ntdef.h |
The CONTAINING_RECORD macro returns the base address of an instance of a structure given the type of the structure and the address of a field within the containing structure. Address [in] PCHAR A pointer to a field in an instance of a structure of type Type. Type [in] TYPE The name of the type of the structure whose base address is to be returned. Field [in] PCHAR The name of the field pointed to by Address and which is contained in a structure of type Type. Return value PCHAR Returns the address of the base of the structure containing Field. Called to determine the base address of a structure whose type is known when the caller has a pointer to a field inside such a structure. This macro is useful for symbolically accessing other fields in a structure of known type. Available starting with Windows 2000. IRQL: Any level |
| IoSkipCurrentIrpStackLocation | Wdm.h |
The IoSkipCurrentIrpStackLocation macro modifies the system's IO_STACK_LOCATION array pointer, so that when the current driver calls the next-lower driver, that driver receives the same IO_STACK_LOCATION structure that the current driver received. Irp [in, out] PIRP A pointer to the IRP. Return value VOID When your driver sends an IRP to the next-lower driver, your driver can call IoSkipCurrentIrpStackLocation if you do not intend to provide an IoCompletion routine (the address of which is stored in the driver's IO_STACK_LOCATION structure). If you call IoSkipCurrentIrpStackLocation before calling IoCallDriver, the next-lower driver receives the same IO_STACK_LOCATION that your driver received. If you intend to provide an IoCompletion routine for the IRP, your driver should call IoCopyCurrentIrpStackLocationToNext instead of IoSkipCurrentIrpStackLocation. If a badly written driver makes the mistake of calling IoSkipCurrentIrpStackLocation and then setting a completion routine, this driver might overwrite a completion routine set by the driver below it. If the driver has pended an IRP, the driver should not be calling IoSkipCurrentIrpStackLocation before it passes the IRP to the next lower driver. If the driver calls IoSkipCurrentIrpStackLocation on a pended IRP before passing it to the next lower driver, the SL_PENDING_RETURNED flag is still set in the Control member of the I/O stack location for the next driver. Because the next driver owns that stack location and might modify it, it could potentially clear the pending flag. This situation might cause the operating system to issue a bug check or the processing of the IRP to never be completed. Instead, a driver that has pended an IRP should call IoCopyCurrentIrpStackLocationToNext to set up a new stack location for the next lower driver before it calls IoCallDriver. If your driver calls IoSkipCurrentIrpStackLocation, be careful not to modify the IO_STACK_LOCATION structure in a way that could unintentionally affect the lower driver or the system's behavior with respect to that driver. Examples include modifying the IO_STACK_LOCATION structure's Parameters union or calling IoMarkIrpPending. Available starting with Windows 2000. IRQL: Any level |
| KeInitializeCallbackRecord | Wdm.h |
The KeInitializeCallbackRecord macro initializes a KBUGCHECK_CALLBACK_RECORD or KBUGCHECK_REASON_CALLBACK_RECORD structure. CallbackRecord [in] PKBUGCHECK_CALLBACK_RECORD Pointer to either a KBUGCHECK_CALLBACK_RECORD or a KBUGCHECK_REASON_CALLBACK_RECORD structure. The structure must be in resident memory, such as nonpaged pool. Return value VOID Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| MM_BAD_POINTER | Wdm.h |
Your driver can use the MM_BAD_POINTER macro as a bad pointer value to assign to a pointer variable that is either uninitialized or no longer valid. An attempt to access the memory location pointed to by this invalid pointer variable will cause a bug check. On many hardware platforms, address 0 (frequently represented as named constant NULL) is an invalid address, but driver developers should not assume that address 0 is universally invalid across all platforms. Setting uninitialized or invalid pointer variables to address 0 might not always guarantee that inappropriate accesses through these pointers will be detected. In contrast, the value MM_BAD_POINTER is guaranteed to be an invalid address on every platform on which a driver runs. On platforms on which address 0 is an invalid address, a driver that accesses address 0 at IRQL < DISPATCH_LEVEL causes an exception (access violation) that can be inadvertently caught by a The following code example shows how to assign the value MM_BAD_POINTER to a pointer variable named PUCHAR ptr = (PUCHAR)MM_BAD_POINTER; // Now *ptr is guaranteed to fault.
After In fact, MM_BAD_POINTER is the base address of an entire page of invalid addresses. Therefore, any access of an address in the range MM_BAD_POINTER to (MM_BAD_POINTER + PAGE_SIZE - 1) will cause a bug check. Starting with Windows 8.1, the MM_BAD_POINTER macro is defined in the Wdm.h header file. However, driver code that uses this macro definition can run in previous versions of Windows starting with Windows Vista. Starting with Windows Vista, the MmBadPointer global variable is available as a pointer to a pointer value that is guaranteed to be an invalid address. However, starting with Windows 8.1, the use of MmBadPointer is deprecated, and you should update your drivers to use the MM_BAD_POINTER macro instead. Available starting with Windows 8.1. Compatible with previous versions of Windows starting with Windows Vista. |
| MmGetMdlByteCount | Wdm.h |
The MmGetMdlByteCount macro returns the length, in bytes, of the buffer described by the specified MDL. Mdl [in] PMDL A pointer to an MDL structure that describes the layout of a virtual memory buffer in physical memory. For more information, see Using MDLs. Return value ULONG MmGetMdlByteCount returns the length, in bytes, of the buffer described by Mdl. Callers of MmGetMdlByteCount can be running at any IRQL. Usually, callers are running at IRQL <= DISPATCH_LEVEL. Available starting with Windows 2000. IRQL: Any level |
| MmGetMdlByteOffset | Wdm.h |
The MmGetMdlByteOffset macro returns the byte offset within the initial page of the buffer described by the given MDL. Mdl [in] PMDL Pointer to an MDL. Return value ULONG MmGetMdlByteOffset returns the offset in bytes. Callers of MmGetMdlByteOffset can be running at any IRQL. Usually, callers are running at IRQL <= DISPATCH_LEVEL. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| MmGetMdlPfnArray | Wdm.h |
The MmGetMdlPfnArray macro returns a pointer to the beginning of the array of physical page numbers that are associated with a memory descriptor list (MDL). Mdl [in] PMDL A pointer to an MDL. Return value PPFN_NUMBER A pointer to the beginning of the array of physical page numbers associated with the MDL. The number of entries in the array is ADDRESS_AND_SIZE_TO_SPAN_PAGES(MmGetMdlVirtualAddress(Mdl), MmGetMdlByteCount(Mdl)). Each array element is an integer value of type PFN_NUMBER, which is defined in Wdm.h as follows: typedef ULONG PFN_NUMBER, *PPFN_NUMBER;
Note Changing the contents of the array can cause subtle system problems that are difficult to diagnose. We recommend that you do not read or change the contents of this array.
For pageable memory, the contents of the array are valid only for a buffer locked with MmProbeAndLockPages. For nonpaged pool, the contents of the array are valid only for an MDL updated with MmBuildMdlForNonPagedPool, MmAllocatePagesForMdlEx, or MmAllocatePagesForMdl. For more information about MDLs, see Using MDLs. Available starting with Windows 2000. IRQL: Any level |
| MmGetMdlVirtualAddress | Wdm.h |
The MmGetMdlVirtualAddress macro returns the base virtual address of a buffer described by an MDL. Mdl [in] PMDL Pointer to an MDL that describes the buffer for which to return the initial virtual address. Return value PVOID MmGetMdlVirtualAddress returns the starting virtual address of the MDL. MmGetMdlVirtualAddress returns a virtual address that is not necessarily valid in the current thread context. Lower-level drivers should not attempt to use the returned virtual address to access memory, particularly user memory space. The returned address, used as an index to a physical address entry in the MDL, can be input to MapTransfer. Callers of MmGetMdlVirtualAddress can be running at any IRQL. Usually, the caller is running at IRQL = DISPATCH_LEVEL because this routine is commonly called to obtain the CurrentVa parameter to MapTransfer. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| MmGetSystemAddressForMdlSafe | Wdm.h |
The MmGetSystemAddressForMdlSafe macro returns a nonpaged system-space virtual address for the buffer that the specified MDL describes. Mdl [in] PMDL Pointer to a buffer whose corresponding base virtual address is to be mapped. Priority [in] MM_PAGE_PRIORITY Specifies an MM_PAGE_PRIORITY value that indicates the importance of success under low available PTE conditions. Specify a priority value of LowPagePriority, NormalPagePriority, or HighPagePriority. Starting with Windows 8, the specified priority value can be bitwise-ORed with the MdlMappingNoWrite or MdlMappingNoExecute flags.
This routine maps the physical pages that are described by the specified MDL into system address space, if they are not already mapped to system address space. Drivers of programmed-I/O (PIO) devices call this routine to map a user-mode buffer, which is described by the MDL at Irp->MdlAddress and which is already mapped to a user-mode virtual address range, to a range in system address space. On entry to this routine, the specified MDL must describe physical pages that are locked down. A locked-down MDL can be built by using the MmProbeAndLockPages, MmBuildMdlForNonPagedPool, IoBuildPartialMdl, or MmAllocatePagesForMdlEx routine. When the system-address-space mapping that is returned by MmGetSystemAddressForMdlSafe is no longer needed, it must be released. The steps that are required to release the mapping depend on how the MDL was built. These are the four possible cases:
Starting with Windows 7 and Windows Server 2008 R2, it is not necessary to explicitly call MmUnmapLockedPages for an MDL that was created by MmAllocatePagesForMdlEx. Instead, a call to the MmFreePagesFromMdl routine releases the system-address-space mapping, if one was allocated. To create a new system-address-space mapping, MmGetSystemAddressForMdlSafe calls MmMapLockedPagesSpecifyCache with the CacheType parameter set to MmCached. A driver that requires a cache type other than MmCached should call MmMapLockedPagesSpecifyCache directly instead of calling MmGetSystemAddressForMdlSafe. For more information about the CacheType parameter, see MmMapLockedPagesSpecifyCache. In a call to MmMapLockedPagesSpecifyCache, the specified cache type is used only if the pages that are described by the MDL do not already have a cache type associated with them. However, in nearly all cases, the pages already have an associated cache type, and this cache type is used by the new mapping. An exception to this rule is for pages that are allocated by MmAllocatePagesForMdl, which sets the cache type to MmCached regardless of the original cache type of the pages. Only one thread at a time can safely call MmGetSystemAddressForMdlSafe for a particular MDL because this routine assumes that the calling thread owns the MDL. However, MmGetSystemAddressForMdlSafe can be called more than one time for the same MDL either by making all calls from the same thread or, if the calls are from multiple threads, by explicitly synchronizing the calls. If a driver must split a request into smaller requests, the driver can allocate additional MDLs, or the driver can use the IoBuildPartialMdl routine. The returned base address has the same offset as the virtual address in the MDL. Windows 98 does not support MmGetSystemAddressForMdlSafe. Use MmGetSystemAddressForMdl instead. Because this macro calls MmMapLockedPagesSpecifyCache, using it may require linking to NtosKrnl.lib. Available starting with Windows 2000. IRQL <= DISPATCH_LEVEL |
| MmInitializeMdl | Wdm.h |
The MmInitializeMdl macro initializes the header of an MDL. MemoryDescriptorList [in] PMDL A pointer to the buffer to initialize as an MDL. For more information, see the following section. BaseVa [in] PVOID A pointer to the base virtual address of a buffer. Length [in] SIZE_T Specifies the length, in bytes, of the buffer to be described by the MDL. This routine supports a maximum buffer length of MAXULONG bytes. Return value VOID The buffer that MemoryDescriptorList points to must be allocated in nonpaged memory. The size, in bytes, of this buffer must be at least sizeof(MDL) + sizeof(PFN_NUMBER)*ADDRESS_AND_SIZE_TO_SPAN_PAGES(BaseVa, Length). Available in Windows 2000 and later versions of Windows. IRQL <= DISPATCH_LEVEL |
| MmPrepareMdlForReuse | Wdm.h |
The MmPrepareMdlForReuse macro releases the resources that are associated with a partial MDL so that the MDL can be reused. Mdl [in] PMDL A pointer to a partial MDL that is to be prepared for reuse. Return value VOID This macro is used by drivers that repeatedly use the same allocated MDL for the TargetMdl parameter in calls to the IoBuildPartialMdl routine. If, in a call to MmPrepareMdlForReuse, the specified partial MDL has an associated mapping to system address space, MmPrepareMdlForReuse releases the mapping so that the MDL can be reused. MmPrepareMdlForReuse accepts only partial MDLs that are built by IoBuildPartialMdl. If MmPrepareMdlForReuse receives an MDL that is mapped to the system address space but was not built by IoBuildPartialMdl, MmPrepareMdlForReuse does not release the mapping, and, in checked builds, causes an assertion to fail. For more information about partial MDLs, see Using MDLs. Available in Windows 2000 and later versions of Windows. IRQL <= DISPATCH_LEVEL |
| PAGE_ALIGN | Wdm.h |
The PAGE_ALIGN macro returns a page-aligned virtual address for a given virtual address. Va [in] PVOID Pointer to the virtual address. Return value PVOID PAGE_ALIGN returns a pointer to the page-aligned virtual address. Available starting with Windows 2000. IRQL: Any level |
| PAGED_CODE | Wdm.h |
The PAGED_CODE macro ensures that the calling thread is running at an IRQL that is low enough to permit paging. Return value VOID If the IRQL > APC_LEVEL, the PAGED_CODE macro causes the system to ASSERT. A call to this macro should be made at the beginning of every driver routine that either contains pageable code or accesses pageable code. The PAGED_CODE macro checks the IRQL only at the point at which the driver code executes the macro. If the code subsequently raises the IRQL, the macro will not detect this change. Driver developers should use Static Driver Verifier and Driver Verifier to detect when the IRQL is raised improperly during the execution of a driver routine. The PAGED_CODE macro works only in checked builds. Available starting with Windows 2000. |
| PAGED_CODE_LOCKED | Wdm.h |
The PAGED_CODE_LOCKED macro asserts that the currently running code section is pageable and must have been locked into memory before it was run. Return value VOID Pageable code must obey certain restrictions (such as IRQL <= APC_LEVEL), unless it is locked into place. A pageable routine that must be locked into place to work correctly should begin with a call to PAGED_CODE_LOCKED. For more information about locking a code section into place, see Locking Pageable Code or Data. |
| PoSetDeviceBusy | Wdm.h |
The PoSetDeviceBusy macro notifies the power manager that the device associated with IdlePointer is busy. IdlePointer [in, out] PULONG Specifies a non-NULL idle pointer that was previously returned by PoRegisterDeviceForIdleDetection. Note that PoRegisterDeviceForIdleDetection might return a NULL pointer. A caller of PoSetDeviceBusy must verify that the pointer is non-NULL before passing it to PoSetDeviceBusy. Return value VOID
Note The PoSetDeviceBusyEx routine is a direct replacement for the PoSetDeviceBusy macro. If you are writing new driver code for Windows Vista with Service Pack 1 (SP1) and later versions of Windows, call PoSetDeviceBusyEx instead of PoSetDeviceBusy.
A driver uses PoSetDeviceBusy along with PoRegisterDeviceForIdleDetection to enable system idle detection for its device. If a device that is registered for idle detection becomes idle, the power manager sends an IRP_MN_SET_POWER request to put the device in a requested sleep state. PoSetDeviceBusy reports that the device is busy, so that the power manager can restart its idle countdown. If the device is not powered up, PoSetDeviceBusy does not change its state. That is, it does not cause the system to send a power-on request. A driver should call PoSetDeviceBusy on every I/O request. Available starting with Windows 2000. IRQL: Any level |
| PsGetCurrentProcess | Ntddk.h |
Returns a pointer to the process of the current thread. Return value A pointer to an opaque process object. Available starting with Windows 2000. IRQL: Any level |
| READ_REGISTER_BUFFER_ULONG64 | Wdm.h |
The READ_REGISTER_BUFFER_ULONG64 macro reads a number of ULONG64 values from the specified register address into a buffer. Register [in] PULONG64 Pointer to the register, which must be a mapped range in memory space. Buffer [out] PULONG64 Pointer to a buffer that an array of ULONG64 values is read into. Count [in] ULONG Specifies the number of ULONG64 values to be read into the buffer. Return value VOID The size of the Buffer buffer must be large enough to contain at least the specified number of ULONG64 values. Callers of the READ_REGISTER_BUFFER_ULONG64 macro can be running at any IRQL, assuming that the Buffer buffer is resident and the Register register is resident, mapped device memory. Available only in 64-bit versions of Windows. IRQL: Any level |
| READ_REGISTER_ULONG64 | Wdm.h |
The READ_REGISTER_ULONG64 macro reads a ULONG64 value from the specified register address. volatile *Register [in] ULONG64 Pointer to the register address, which must be a mapped range in memory space. Return value ULONG64 READ_REGISTER_ULONG64 returns the ULONG64 value that is read from the specified register address. Callers of the READ_REGISTER_ULONG64 macro can be running at any IRQL, assuming the Register address is resident, mapped device memory. Available only in 64-bit versions of Windows. IRQL: Any level |
| ROUND_TO_PAGES | Wdm.h |
The ROUND_TO_PAGES macro takes a size in bytes and rounds it up to the next full page. Size [in] ULONG_PTR Specifies the size in bytes to round up to a page multiple. Return value ULONG_PTR ROUND_TO_PAGES returns the input size rounded up to a multiple of the virtual memory page size for the current platform. Callers of ROUND_TO_PAGES can be running at any IRQL. The caller must ensure that the supplied parameter cannot cause memory overflow. IRQL: Any level |
| RtlEqualLuid | Wdm.h |
Return value
Available starting with Windows 2000. IRQL: Any level |
| RtlInitEmptyAnsiString | Wdm.h |
The RtlInitEmptyAnsiString macro initializes an empty counted ANSI string. DestinationString [out] PANSI_STRING Pointer to the ANSI_STRING structure to be initialized. Buffer [in] PCHAR Pointer to a caller-allocated buffer to be used to contain a WCHAR string. BufferSize [in] USHORT Length, in bytes, of the buffer that Buffer points to. Return value VOID The members of the structure that the DestinationString parameter points to are initialized as follows.
To initialize a non-empty counted Unicode string, call RtlInitAnsiString. Available in Microsoft Windows XP and later versions of Windows. IRQL: Any level |
| RtlInitEmptyUnicodeString | Wdm.h |
The RtlInitEmptyUnicodeString macro initializes an empty counted Unicode string. DestinationString [out] PUNICODE_STRING Pointer to the UNICODE_STRING structure to be initialized. Buffer [in] PWCHAR Pointer to a caller-allocated buffer to be used to contain a WCHAR string. BufferSize [in] USHORT Length, in bytes, of the buffer that Buffer points to. Return value VOID The members of the structure that the DestinationString parameters points to are initialized as follows.
To initialize a non-empty counted Unicode string, call RtlInitUnicodeString. Available starting with Windows XP. IRQL: Any level |
| RtlIsZeroLuid | Ntddk.h |
The RtlIsZeroLuid macro determines if the specified LUID is the zero LUID. L1 [in] PLUID Specifies the LUID to check. Return value BOOLEAN RtlIsZeroLuid returns TRUE if L1 is zero, and returns FALSE otherwise. IRQL: Any level |
| RtlRetrieveUlong | Wdm.h |
The RtlRetrieveUlong macro retrieves a ULONG value from the source address, avoiding alignment faults. The destination address is assumed to be aligned. DestinationAddress [out] PULONG Pointer to a ULONG-aligned location in which to store the ULONG value. SourceAddress [in] PULONG Pointer to a location from which to retrieve the ULONG value. Return value VOID Callers of RtlRetrieveUlong can be running at any IRQL if the given addresses are in nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL. Available in Windows 2000 and later versions of Windows. |
| RtlRetrieveUshort | Wdm.h |
The RtlRetrieveUshort macro retrieves a USHORT value from the source address, avoiding alignment faults. DestinationAddress [out] PUSHORT Pointer to a USHORT-aligned location in which to store the value. SourceAddress [in] PUSHORT Pointer to a location from which to retrieve the value. Return value VOID Callers of RtlRetrieveUshort can be running at any IRQL if the given addresses are in nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| RtlStoreUlong | Wdm.h |
The RtlStoreUlong macro stores a ULONG value at a particular address, avoiding alignment faults. Address [out] PULONG A pointer to a location in which to store the specified ULONG value. Value [in] ULONG Specifies a ULONG value to be stored. Return value VOID The caller can be running at any IRQL if Address points to nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| RtlStoreUlonglong | Wdm.h |
The RtlStoreUlonglong macro stores a specified ULONGLONG value at a specified memory address, avoiding memory alignment faults. Address [out] PULONGLONG A pointer to a location in which to store the specified ULONGLONG value. Value [in] ULONGLONG The ULONGLONG value to be stored. Return value VOID RtlStoreUlonglong avoids memory alignment faults. If the address specified by Address is not aligned to the storage requirements of a ULONGLONG, RtlStoreUlonglong stores the bytes of Value beginning at the memory location (PUCHAR)Address. RtlStoreUlonglong runs at any IRQL if Address points to nonpaged pool; otherwise, it must run at IRQL <= APC_LEVEL. Available starting with Windows 2000. IRQL: Any level |
| RtlStoreUlongPtr | Wdm.h |
The RtlStoreUlongPtr macro stores a specified ULONG_PTR value at a specified memory location, avoiding memory alignment faults. Address [out] PULONG_PTR A pointer to a location in which to store the ULONG_PTR value. Value [in] ULONG_PTR Specifies the ULONG_PTR value to be stored. Return value VOID RtlStoreUlongPtr avoids memory alignment faults. If the value of Address is not aligned to the storage requirements of a ULONG_PTR, RtlStoreUlongPtr stores the bytes of Value beginning at the memory location (PUCHAR)Address. RtlStoreUlongPtr runs at any IRQL if Address points to nonpaged pool; otherwise it must run at IRQL <= APC_LEVEL. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| RtlStoreUshort | Wdm.h |
The RtlStoreUshort macro stores a USHORT value at a particular address, avoiding alignment faults. Address [out] PUSHORT A pointer to a location in which to store the specified USHORT value. Value [in] USHORT Specifies a USHORT value to be stored. Return value VOID The caller can be running at any IRQL if Address points to nonpaged pool. Otherwise, the caller must be running at IRQL <= APC_LEVEL. Available in Windows 2000 and later versions of Windows. IRQL: Any level |
| WRITE_REGISTER_BUFFER_ULONG64 | Wdm.h |
The WRITE_REGISTER_BUFFER_ULONG64 macro writes a number of ULONG64 values from a buffer to the specified register. Register [in] PULONG64 Pointer to the register, which must be a mapped range in memory space. Buffer [in] PULONG64 Pointer to a buffer that an array of ULONG64 values is to be written to. Count [in] ULONG Specifies the number of ULONG64 values to be written to the register. Return value VOID The size of the Buffer buffer must be large enough to contain at least the specified number of ULONG64 values. Callers of the WRITE_REGISTER_BUFFER_ULONG64 macro can be running at any IRQL, assuming that the Buffer buffer is resident and the Register register is resident, mapped device memory. Available only in 64-bit versions of Windows. IRQL: Any level |
| WRITE_REGISTER_ULONG64 | Wdm.h |
The WRITE_REGISTER_ULONG64 macro writes a ULONG64 value to the specified address. volatile *Register [in] ULONG64 Pointer to the register, which must be a mapped range in memory space. Value [in] ULONG64 Specifies a ULONG64 value to write to the register. Return value VOID Callers of the WRITE_REGISTER_ULONG64 macro can be running at any IRQL, assuming the Register register is resident, mapped device memory. Available only in 64-bit versions of Windows. IRQL: Any level |
| ZwCurrentProcess | Wdm.h |
The ZwCurrentProcess macro returns a handle to the current process. Return value HANDLE ZwCurrentProcess returns a special handle value that represents the current process. The returned value is not a true handle, but it is a special value that always represents the current process. NtCurrentProcess and ZwCurrentProcess are two versions of the same Windows Native System Services routine. The NtCurrentProcess routine in the Windows kernel is not directly accessible to kernel-mode drivers. However, kernel-mode drivers can access this routine indirectly by calling ZwCurrentProcess. For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines. All supported operating systems. IRQL: Any level |
| ZwCurrentThread | Wdm.h |
The ZwCurrentThread macro returns a handle to the current thread. Return value HANDLE ZwCurrentThread returns a special handle value that represents the current thread. The returned value is not a true handle, but it is a special value that always represents the current thread. NtCurrentThread and ZwCurrentThread are two versions of the same Windows Native System Services routine. The NtCurrentThread routine in the Windows kernel is not directly accessible to kernel-mode drivers. However, kernel-mode drivers can access this routine indirectly by calling the ZwCurrentThread routine. For calls from kernel-mode drivers, the NtXxx and ZwXxx versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the NtXxx and ZwXxx versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines. All supported operating systems. IRQL: Any level |