Got BSOD with KeSaveExtendedProcessorState

Question

I used KeSaveExtendedProcessorState/KeRestoreExtendedProcessorState to save and restore extended processor states before in a device driver for Windows 7 64 bits, I got BSOD with KeSaveExtendedProcessorState, may you help.

I used RtlGetEnabledExtendedFeatures((ULONG64)(-1)) to get the enabled extended features ( the returned value is 0x3), and use it as the first parameter for KeSaveExtendedProcessorState, and I used MmAllocateContiguousMemory(sizeof(XSTATE_SAVE), highAddress) with highAddress = 0xbfffffff to allocate the nonpaged memory used to save the extended states, and raised IRQL to DISPATCH_LEVEL before KeSaveExtendedProcessorState. I got BSOD with following message:

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

INVALID_EXTENDED_PROCESSOR_STATE (131)
Invalid combination of parameters was detected while saving or restoring
extended processor state.
Arguments:
Arg1: 0000000000000000, Invalid feature mask was passed or extended processor state is
                not enabled.
Arg2: 0000000000800000, Nonzero if extended state is enabled.
Arg3: 0000000000000003, The low 32 bits of the feature mask.
Arg4: 0000000000000000, The high 32 bits of the feature mask.

What did I miss?

Thanks.

Regards, David

Answer 1

Too late now to help with your programming, but what you missed is that the implementation of KeSaveExtendedProcessorState in 64-bit Windows 7 - not 32-bit and not Windows 8 and higher - requires that the processor supports extended processor states, which yours does not. It anyway regards both bits of XSTATE_MASK_LEGACY as invalid in the Mask argument.

The price to you for missing this is exactly your bug check. There is no need for "a bit more code". Of course, you're not alone in having missed it. Microsoft missed it in the documentation, too, but the price of this to Microsoft is less than nothing.

A decade later and in my assessing whether the function is worth my trouble to document I wonder if any real-world programmer ever got caught. Thus does Stack Overflow show it's eventually good for an answer.