Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Sending IOCTL's from kernel to user mode

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Hi,

My basic need is that I have to pass a structure from my filter driver to the user mode, which will do some
processing based on the structure, and then let the driver know once it is finished.

Presently I have thought of 2 solutions,

- Call the user mode directly using "IOCTL" and pass the structure along with it. What I would like to know is how I can make
the "IOCTL" calls from kernel to the user mode.

- Have a thread in the user mode which would wait for an event. I can set this event in the kernel and then
the user mode can make the IOCTL, but I am not sure of how I can share an event between the user mode and kernel mode and secondly,
this solution would be a bit more expensive (with two calls involved) than the first one. So I would prefer the first solution, since
the volume of calls being made will be high.

Any help will be appreciated,

thanks,
Almas

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    A first solution could be calling from user mode to kernel (by IOCTL) and
    keep this thread waiting in kernel mode, i.e, not returning to user mode
    until
    being signaled.
    Then signal from kernel to the waiting thread when you have some data to
    transfer. The IOCTL thread
    then will pick the data and return to user mode. This simulates the effect
    you want, i.e, you dont call from driver to
    user mode but it looks the same.

    The second technique is to share a memory space between kernel and user mode
    and then use
    events to synchronize kernel and user threads. This technique is better than
    above when you have a high traffic.
    No calls at all are necessary because this way the user mode thread will not
    do the trip to kernel (by calling IOCTL), but instead will pick the data
    from the shared buffer. The easiest way to share a buffer between kernel and
    user mode is mapping a section.

    Hope this helps.

    Inaki.

    > -----Original Message-----
    > From: Almas Khan
    > Sent: martes 4 de abril de 2000 13:19
    > To: File Systems Developers
    > Subject: [ntfsd] Sending IOCTL's from kernel to user mode
    >
    > Hi,
    >
    > My basic need is that I have to pass a structure from my filter driver to
    > the user mode, which will do some
    > processing based on the structure, and then let the driver know once it is
    > finished.
    >
    > Presently I have thought of 2 solutions,
    >
    > - Call the user mode directly using "IOCTL" and pass the structure along
    > with it. What I would like to know is how I can make
    > the "IOCTL" calls from kernel to the user mode.
    >
    > - Have a thread in the user mode which would wait for an event. I can set
    > this event in the kernel and then
    > the user mode can make the IOCTL, but I am not sure of how I can share an
    > event between the user mode and kernel mode and secondly,
    > this solution would be a bit more expensive (with two calls involved) than
    > the first one. So I would prefer the first solution, since
    > the volume of calls being made will be high.
    >
    > Any help will be appreciated,
    >
    > thanks,
    > Almas
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hello,

    AFAIK it is not possible to make IOCTL calls from
    kernel mode to user mode.

    For event sharing, one can create the event in user
    mode using CreateEvent call and open the event in
    kernel mode using ZwOpenEvent call. e.g If you create
    a event say "MyEvent" in user mode then you can open
    the event in kernel mode using the name
    "\BaseNamedObjects\MyEvent".

    Alternatively you can create a event named
    \BaseNamedObjects\MyEvent in kernel mode using the
    ZwCreateEvent call and open it in user mode using
    OpenEvent call.

    The better approach would be to create a named section
    object and pair of event objects.

    e.g Create two events say "DataArrived" and
    "DataCaptured" and one section (memory mapping) object
    say "DataBuffer" in user mode. The user mode thread
    will wait on the "DataArrived" event. Whenever the
    filter driver needs to send some data, it will open
    the section object \BaseNamedObjects\DataBuffer using
    ZwOpenSection call, map view using ZwMapViewOfSection
    and write data structure in to it. Next it will open
    the events named \BaseNamedObjects\DataArrived and
    \BaseNamedObjects\DataCaptured. It will signal the
    "DataArrived" event and wait on the "DataCaptured"
    event. When the "DataArrived" event is signalled, the
    user mode code will pick up the data in shared section
    and signal the "DataCaptured" event. This will allow
    your filter driver to come out of wait.

    Hope this helps.

    -Prasad


    --- Almas Khan <[email protected]> wrote:
    > Hi,
    >
    > My basic need is that I have to pass a structure
    > from my filter driver to the user mode, which will
    > do some
    > processing based on the structure, and then let the
    > driver know once it is finished.
    >
    > Presently I have thought of 2 solutions,
    >
    > - Call the user mode directly using "IOCTL" and pass
    > the structure along with it. What I would like to
    > know is how I can make
    > the "IOCTL" calls from kernel to the user mode.
    >
    > - Have a thread in the user mode which would wait
    > for an event. I can set this event in the kernel and
    > then
    > the user mode can make the IOCTL, but I am not sure
    > of how I can share an event between the user mode
    > and kernel mode and secondly,
    > this solution would be a bit more expensive (with
    > two calls involved) than the first one. So I would
    > prefer the first solution, since
    > the volume of calls being made will be high.
    >
    > Any help will be appreciated,
    >
    > thanks,
    > Almas
    >
    > ---
    > You are currently subscribed to ntfsd as:
    > [email protected]
    > To unsubscribe send a blank email to
    > $subst('Email.Unsub')
    >
    >

    =====
    Prasad S. Dabak
    Director of Engineering, Windows NT/2000 Division
    Cybermedia Software Private Limited
    http://www.cybermedia.co.in
    Co-author of the book "Undocumented Windows NT"
    ISBN 0764545698

    __________________________________________________
    Do You Yahoo!?
    Talk to your friends online with Yahoo! Messenger.
    http://im.yahoo.com
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Many thanks for the help. I am going for the first solution, though, and just putting in more user threads so that they can handle
    the volume of traffic.

    Almas
    >
    >
    > A first solution could be calling from user mode to kernel (by IOCTL) and
    > keep this thread waiting in kernel mode, i.e, not returning to user mode
    > until
    > being signaled.
    > Then signal from kernel to the waiting thread when you have some data to
    > transfer. The IOCTL thread
    > then will pick the data and return to user mode. This simulates the effect
    > you want, i.e, you dont call from driver to
    > user mode but it looks the same.
    >
    > The second technique is to share a memory space between kernel and user mode
    > and then use
    > events to synchronize kernel and user threads. This technique is better than
    > above when you have a high traffic.
    > No calls at all are necessary because this way the user mode thread will not
    > do the trip to kernel (by calling IOCTL), but instead will pick the data
    > from the shared buffer. The easiest way to share a buffer between kernel and
    > user mode is mapping a section.
    >
    > Hope this helps.
    >
    > Inaki.
    >
    > > -----Original Message-----
    > > From: Almas Khan
    > > Sent: martes 4 de abril de 2000 13:19
    > > To: File Systems Developers
    > > Subject: [ntfsd] Sending IOCTL's from kernel to user mode
    > >
    > > Hi,
    > >
    > > My basic need is that I have to pass a structure from my filter driver to
    > > the user mode, which will do some
    > > processing based on the structure, and then let the driver know once it is
    > > finished.
    > >
    > > Presently I have thought of 2 solutions,
    > >
    > > - Call the user mode directly using "IOCTL" and pass the structure along
    > > with it. What I would like to know is how I can make
    > > the "IOCTL" calls from kernel to the user mode.
    > >
    > > - Have a thread in the user mode which would wait for an event. I can set
    > > this event in the kernel and then
    > > the user mode can make the IOCTL, but I am not sure of how I can share an
    > > event between the user mode and kernel mode and secondly,
    > > this solution would be a bit more expensive (with two calls involved) than
    > > the first one. So I would prefer the first solution, since
    > > the volume of calls being made will be high.
    > >
    > > Any help will be appreciated,
    > >
    > > thanks,
    > > Almas
    > >
    > > ---
    > > You are currently subscribed to ntfsd as: [email protected]
    > > To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
    >
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE