Beware Windows exit codes

I have a Java process that is forked from a Windows service; the service process monitors the child Java process to make sure it's OK.

However, I was seeing in my logs that sometimes I would get the exit code 143. My code does not generate this exit code; further, there are no .dmp files or Java crash reports or exceptions logged or any other indication in my code that the process exited. The explanation is simple: my service and all other processes were receiving CTRL_SHUTDOWN_EVENT. My service process ignores this, but Java does not (see IBM's excellent document on Java Signal Handling).

The result is that my Java process would exit, my monitor would not know why, and restart it, at which time it would again get a shutdown event, etc, until the machine actually completed its shutdown.

Needless to say my service process now watches for those events...

AddVectoredExceptionHandler prevents Purify from working

In all our Windows executables we AddVectoredExceptionHandler so that we can get .dmp files when things crash. However, I recently discovered that doing so preventsPurify from working correctly on Windows. This should probably be expected, and I'm probably not chaining to the next handler correctly, but it's something to watch out for.

Subtopic #1: In all other operating systems, if you want a core dump file, it's very straight-forward; you ulimit -c unlimited, and you get core files. In Windows, you have to write your own Dump file from code that you write. You could depend on Dr. Watson, or Windows Error Reporting, but if you want your own dump file in a place where you or your customers can find it, you have to write it yourself.

Subtopic #2: Fifteen years ago, Purify was the most important development tool you could have. It's still the most important development tool you could have, except that it hasn't really changed in 15 years. I have several friends that are ex-Pure, and they are also dismayed at how it's just not keeping up. For instance:

• It wasn't until 2004 (or was it 2006?) that you could really use Purify on Linux. Wow.
• We still can't Purify JNI C code in a Java JVM on Linux. The JVM does magic things that Purify can't handle. Oh well.
• Purify for Windows doesn't even work on x64.

WDK 6001.18001 NDISPROT 5x cancel code bug

I spent some time determining that the sample code for ndisprot that is included in the 6001.18001 WDK has a bug in the IRP cancel code. What's worse is that the bug only exists in the directory labeled 5x, not the directory labeled 60.

For some (at least 2) of the samples in the latest WDK's, they made a clean break from the NDIS 5.x and earlier sample code when they wrote the samples for NDIS 6.0. In the NDIS 6.0 sample they wrote the cancel code according to the pseudo code in MSDN. Unfortunately, they didn't back-port those changes/fixes to the sample code in the 5x directory (sample code intended for NDIS 5.x)

My full description/conversation is here:

http://www.osronline.com/showthread.cfm?link=142677

Platform specific IP routing behavior

The code I'm working on manipulates routing tables on three different platforms: Linux, Windows and Solaris. Each of them has a different behavior for different scenarios. Here I attempt to document those differences.

First some definitions:

• Interface A device which can directly reach a subnet via ARP or other protocols. An example is eth0.
• Direct route A route which indicates which Interface to use to reach a directly connected subnet.
• Gateway route A route which indicates a gateway to use to reach a subnet which is connected via a router.
• Default route A special case of a Gateway route in which the destination subnet is all possible addresses.
• Host route A special case of any of either a Direct route or a Gateway route in which the destination is a single machine.
• Multicast route A special case of a Direct route in which the destination subnet is the multicast address space, 224.0.0.0/8 or a subset thereof.

Note that example route entries in this table is based on the format emitted from Linux's /sbin/ip/route.

		Linux 2.6		Windows 2003		Solaris 10
The interface chosen to access a gateway via a route is determined by traversing the route table, not hardcoded into the route entry. For instance, default via 192.168.0.1 does not need the specification dev eth0, because that is determined by finding the direct route 192.168.0.0/24 dev eth0.		no		no		yes1
A Gateway route which is also a Host route can be added where the destination is an address that exists in a subnet of another Direct route. For instance, the route 192.168.0.20/32 via 192.168.0.1 dev eth0 exists while the direct route192.168.0.0/24 dev eth0 also exists.		yes2		yes2		yes2
A Direct route which is also a Host route can be added where the destination is an address that exists in a subnet of another Direct route. For instance, the route 192.168.0.20/32 dev eth0 exists while the direct route 192.168.0.0/24 dev eth0 also exists.		yes		yes		yes
Direct routes can be deleted.		yes		yes3		yes
Route priority can be programmatically controlled.		yes		yes		no4
When an interface is administratively taken down, do the associated Direct route entries disappear?		yes		yes		yes
When an interface is administratively taken down, and associated Direct route entries disappear, do they return when the interface is brought up again?		yes		yes		yes
When an interface is administratively taken down, do the associated Gateway route entries disappear?		yes		yes		yes
When an interface is administratively taken down, and associated Gateway route entries disappear, do they return when the interface is brought up again?		no		yes		no
When an interface is administratively down, is it an error to add a route that references that interface?		yes		yes		yes
When an interface is unplugged, do the associated route entries disappear?		no		yes		no
When an interface is unplugged, and associated route entries disappear, do they return when the interface is plugged in again?		N/A		yes		N/A
When an interface is unplugged, is it an error to add a route that references that interface?		no		yes5		no
When an interface is unplugged, and associated route entries do not disappear, will an alternate route be chosen because the interface is unplugged?		no		N/A		no
If two interfaces are connected to the same subnet, will ARPrespond on either interface for an address on one of the interfaces?		yes		no		no
Can routes be modified for all attributes including priority? An answer of no means they must be destroyed and recreated to modify attributes.		no		yes		no
Does the operating system create Multicast routes by default?		no		yes		no
Can multicast routes be deleted?		yes		yes3		yes
If Multicast routes do not exist, do multicast packets exit the machine? To where?		yes6		no		no
Can two routes be created with the same destination and priority, but a different interface?		no		yes		yes7
Can a Gateway route be specified with an interface, where that interface does not have a Direct route for the gateway in the Gateway route?		no8		yes9		no8
When you remove a Direct route which is required by a Gateway route to reach the gateway, does the Gateway route disappear?		no		no		no
If you specify a Gateway route with a gateway that is not reachable via a Direct route, is this allowed?		no		yes10		no

¹ This configuration is possible if the route entry is set for this behavior. The route entry can also be configured for a specific interface.

² When a ping is performed on the destination address, it is sent to the gateway, not via the direct route; this is what should be expected by following the rules in reading a route table. However, the gateway in my test was a Linux 2.6 machine, and it rejected the ping with an ICMP of "unreachable." This means such a configuration is possible, but useless.

³ One cannot directly delete a default route or other "protected" routes, but there is a way to fool Windows into deleting it. I found this fascinating discussion

⁴ The metric attribute cannot be set for a route in Solaris.

⁵ The error that's returned is ERROR_INVALID_PARAMETER. That doesn't differentiate this condition from other problems.

⁶ It appears to choose the first available interface.

⁷ This question is partly irrelevant in Solaris; the priority or metric cannot be set for a route. However, you can create two routes with the same destination but different interfaces.

⁸ It works even if the Direct route is on another interface, but it must exist.

⁹ You can set the route, but it doesn't do anything.

¹⁰ This strange behavior is apparently allowed; the source address that's used is the address on the interface that is preferred for the Default gateway.

Finding memory leaks in Windows

I was trying to figure out where a memory leak was coming from on Windows, and didn't have the luxury of using Purify, and this really helped:

http://blogs.msdn.com/greggm/archive/2004/02/12/72209.aspx

Essentially, VirtualAlloc is the equivalent of sbrk in other OS's, and allocates virtual pages to the process. If you can find out what's calling that all the time, you're likely to discover what's allocating memory.