Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


YASQ

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Yet another stupid question...

I've been having a heck of a time with blocking user requests. I tracked a BSOD problem I was having to calling KeWaitForSingleObject with a KEVENT allocated in the paged pool. However, I'm now stuck trying to block a thread for the completion of a pending read via ZwReadFile().

The NT4 DDK docs say you can wait on a HANDLE returned by ZwCreateFile() (if you specify the SYNCHRONIZE flag). Being somewhat naive, I tried doing just that but I get a BSOD when I call KeWaitForSingleObject on the handle. Alternatively, I can create an event (in non-paged memory of course) but when I pass it into ZwReadFile (as the 2nd argument) I get a STATUS_INVALID_HANDLE.

So, the question is how does one go about waiting on handles or file objects if they aren't allocated as non-paged? Or, how does one create an event that can be passed to ZwReadFile?

thanks,

david

ps, seems like there have been lots of dispatcher-object related questions on this list of late. Is there something I should read that would make this all clear to me? (I've read bits of DDK documentation in MSDN, Inside WinNT, the OSR driver book, and Nagar's FS book.)

Comments

  • OSR_Community_User-35OSR_Community_User-35 Member Posts: 154
    KeWait... doesn't operate on handles. You need to reference the
    handle to get an object pointer.

    How are you getting a handle to the event you create?
    KeInitializeEvent() operates on nonpaged pool memory to create a valid
    KEVENT object, but not a handle.

    -----------------------------------------------------------------------
    Dave Cox
    Hewlett-Packard Co.
    HPSO/SSMO (Santa Barbara)
    https://ecardfile.com/id/Dave+Cox


    -----Original Message-----
    From: david c. steere [mailto:[email protected]]
    Sent: Monday, May 08, 2000 2:04 PM
    To: File Systems Developers
    Subject: [ntfsd] YASQ


    Yet another stupid question...

    I've been having a heck of a time with blocking user requests. I tracked a
    BSOD problem I was having to calling KeWaitForSingleObject with a KEVENT
    allocated in the paged pool. However, I'm now stuck trying to block a thread
    for the completion of a pending read via ZwReadFile().

    The NT4 DDK docs say you can wait on a HANDLE returned by ZwCreateFile() (if
    you specify the SYNCHRONIZE flag). Being somewhat naive, I tried doing just
    that but I get a BSOD when I call KeWaitForSingleObject on the handle.
    Alternatively, I can create an event (in non-paged memory of course) but
    when I pass it into ZwReadFile (as the 2nd argument) I get a
    STATUS_INVALID_HANDLE.

    So, the question is how does one go about waiting on handles or file objects
    if they aren't allocated as non-paged? Or, how does one create an event that
    can be passed to ZwReadFile?

    thanks,

    david

    ps, seems like there have been lots of dispatcher-object related questions
    on this list of late. Is there something I should read that would make this
    all clear to me? (I've read bits of DDK documentation in MSDN, Inside WinNT,
    the OSR driver book, and Nagar's FS book.)


    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > I've been having a heck of a time with blocking user requests. I tracked a
    >BSOD problem I was having to calling KeWaitForSingleObject with a
    >KEVENT allocated in the paged pool.

    Never do this terrible thing :-) this is a guarateed BSOD.
    All dispatcher objects must be allocated nonpaged - they are accessed by
    the kernel functions on DISPATCH_LEVEL and with KiDispatcherLock held.

    >KeWaitForSingleObject on the handle. Alternatively, I can create an event
    >(in non-paged memory of course) but when I pass it into ZwReadFile (as the
    >2nd argument) I get a STATUS_INVALID_HANDLE.

    You must pass a _handle_ to the event, not a pointer. Handles can be
    created only to objects allocated as real Object Manager's objects, not by
    some arbitrary code of yours. So, the only way of doing this is:
    - allocate the event using IoCreateNotificationEvent - this will return a
    handle
    - convert the handle to the pointer by ObReferenceObjectByHandle
    - pass the handle to ZwReadFile (BTW, this function will also do
    ObReferenceObjectByHandle on the event and set the pointer to
    Irp->UserEvent)
    - wait on the pointer by KeWaitForSingleObject
    - close the pointer by ObDereferenceObject
    - close the handle by ZwClose

    Max
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    I've tried waiting in 2 different ways:
    - KeWait... on a handle returned from ZwCreateFile and on a file object
    - passing an event (alloc'd from the nonpaged pool and initialized via KeInitEvent()) to ZwReadFile, and waiting on it with KeWait...

    The first method failed in a BSOD, either on the wait or later (when the process exited). The second method failed because ZwReadFile returned an error (invalid handle). I have successfully used events, some that were allocated in the non-paged pool and some that were part of the device extension (which is non-paged). Several people have mentioned waiting on a file object but I've yet been able to successfully do it.

    david.


    At 03:42 PM 5/8/00 -0600, you wrote:
    >KeWait... doesn't operate on handles. You need to reference the
    >handle to get an object pointer.
    >
    >How are you getting a handle to the event you create?
    >KeInitializeEvent() operates on nonpaged pool memory to create a valid
    >KEVENT object, but not a handle.
    >
    >-----------------------------------------------------------------------
    >Dave Cox
    >Hewlett-Packard Co.
    >HPSO/SSMO (Santa Barbara)
    >https://ecardfile.com/id/Dave+Cox
    >
    >
    >-----Original Message-----
    >From: david c. steere [mailto:[email protected]]
    >Sent: Monday, May 08, 2000 2:04 PM
    >To: File Systems Developers
    >Subject: [ntfsd] YASQ
    >
    >
    >Yet another stupid question...
    >
    >I've been having a heck of a time with blocking user requests. I tracked a
    >BSOD problem I was having to calling KeWaitForSingleObject with a KEVENT
    >allocated in the paged pool. However, I'm now stuck trying to block a thread
    >for the completion of a pending read via ZwReadFile().
    >
    >The NT4 DDK docs say you can wait on a HANDLE returned by ZwCreateFile() (if
    >you specify the SYNCHRONIZE flag). Being somewhat naive, I tried doing just
    >that but I get a BSOD when I call KeWaitForSingleObject on the handle.
    >Alternatively, I can create an event (in non-paged memory of course) but
    >when I pass it into ZwReadFile (as the 2nd argument) I get a
    >STATUS_INVALID_HANDLE.
    >
    >So, the question is how does one go about waiting on handles or file objects
    >if they aren't allocated as non-paged? Or, how does one create an event that
    >can be passed to ZwReadFile?
    >
    >thanks,
    >
    >david
    >
    >ps, seems like there have been lots of dispatcher-object related questions
    >on this list of late. Is there something I should read that would make this
    >all clear to me? (I've read bits of DDK documentation in MSDN, Inside WinNT,
    >the OSR driver book, and Nagar's FS book.)
    >
    >
    >---
    >You are currently subscribed to ntfsd as: [email protected]
    >To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    >---
    >You are currently subscribed to ntfsd as: [email protected]
    >To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_User-35OSR_Community_User-35 Member Posts: 154
    Again, it sounds like you are mixing too freely simple structs, true
    Object Manager objects, and object handles. KeWait... and ZwXyzFile
    are very particular about what form of synchronization "object" you
    pass.

    As far as I know, KeWaitForSingleObject() only works on pointers to
    structs that start with a DISPATCHER_HEADER struct, such as KEVENT.
    You cannot use any sort of handle (it's not a pointer to a struct),
    and I imagine you cannot use a FILE_OBJECT pointer because it doesn't
    start with a DISPATCHER_HEADER.

    On the other hand, the "event" you pass to ZwReadFile() MUST be a handle
    to an event, not a pointer to a KEVENT you've set up with
    KeInitializeEvent().

    If you have a handle (event or file-object) and want to wait on it,
    try ZwWaitForSingleObject(), and its kindred, which are documented in
    Nebbett's Native API Reference, but not in the DDK. These work on
    handles, not DISPATCHER_HEADER structs. ZwWaitForSingleObject() is
    prototyped in NTIFS.H.

    -----------------------------------------------------------------------
    Dave Cox
    Hewlett-Packard Co.
    HPSO/SSMO (Santa Barbara)
    https://ecardfile.com/id/Dave+Cox


    -----Original Message-----
    From: david c. steere [mailto:[email protected]]
    Sent: Monday, May 08, 2000 9:18 PM
    To: File Systems Developers
    Subject: [ntfsd] RE: YASQ


    I've tried waiting in 2 different ways:
    - KeWait... on a handle returned from ZwCreateFile and on a file
    object
    - passing an event (alloc'd from the nonpaged pool and initialized
    via KeInitEvent()) to ZwReadFile, and waiting on it with KeWait...

    The first method failed in a BSOD, either on the wait or later (when the
    process exited). The second method failed because ZwReadFile returned an
    error (invalid handle). I have successfully used events, some that were
    allocated in the non-paged pool and some that were part of the device
    extension (which is non-paged). Several people have mentioned waiting on a
    file object but I've yet been able to successfully do it.

    david.


    At 03:42 PM 5/8/00 -0600, you wrote:
    >KeWait... doesn't operate on handles. You need to reference the
    >handle to get an object pointer.
    >
    >How are you getting a handle to the event you create?
    >KeInitializeEvent() operates on nonpaged pool memory to create a valid
    >KEVENT object, but not a handle.
    >
    >-----------------------------------------------------------------------
    >Dave Cox
    >Hewlett-Packard Co.
    >HPSO/SSMO (Santa Barbara)
    >https://ecardfile.com/id/Dave+Cox
    >
    >
    >-----Original Message-----
    >From: david c. steere [mailto:[email protected]]
    >Sent: Monday, May 08, 2000 2:04 PM
    >To: File Systems Developers
    >Subject: [ntfsd] YASQ
    >
    >
    >Yet another stupid question...
    >
    >I've been having a heck of a time with blocking user requests. I tracked a
    >BSOD problem I was having to calling KeWaitForSingleObject with a KEVENT
    >allocated in the paged pool. However, I'm now stuck trying to block a
    thread
    >for the completion of a pending read via ZwReadFile().
    >
    >The NT4 DDK docs say you can wait on a HANDLE returned by ZwCreateFile()
    (if
    >you specify the SYNCHRONIZE flag). Being somewhat naive, I tried doing just
    >that but I get a BSOD when I call KeWaitForSingleObject on the handle.
    >Alternatively, I can create an event (in non-paged memory of course) but
    >when I pass it into ZwReadFile (as the 2nd argument) I get a
    >STATUS_INVALID_HANDLE.
    >
    >So, the question is how does one go about waiting on handles or file
    objects
    >if they aren't allocated as non-paged? Or, how does one create an event
    that
    >can be passed to ZwReadFile?
    >
    >thanks,
    >
    >david
    >
    >ps, seems like there have been lots of dispatcher-object related questions
    >on this list of late. Is there something I should read that would make this
    >all clear to me? (I've read bits of DDK documentation in MSDN, Inside
    WinNT,
    >the OSR driver book, and Nagar's FS book.)
    >
    >
    >---
    >You are currently subscribed to ntfsd as: [email protected]
    >To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    >---
    >You are currently subscribed to ntfsd as: [email protected]
    >To unsubscribe send a blank email to $subst('Email.Unsub')


    ---
    You are currently subscribed to ntfsd as: [email protected]
    To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Actually, you can wait on a file object. However, if you're using the
    KeWait family, you must wait on &FileObject->Event, not on FileObject. You
    can use file handles with the ZwWait family as well.

    In general, waiting on a file object isn't terribly useful. If the file is
    opened for asynchronous IO (overlapped,) then you cannot be sure which
    read/write operation completed if multiple operations were initiated. If
    the file is opened for synchronous IO, then the requesting thread will block
    until the operation is complete.

    > -----Original Message-----
    > From: COX,DAVID (HP-Roseville,ex1) [mailto:[email protected]]
    > Sent: Wednesday, May 10, 2000 12:58 PM
    > To: File Systems Developers
    > Subject: [ntfsd] RE: YASQ
    >
    >
    > Again, it sounds like you are mixing too freely simple structs, true
    > Object Manager objects, and object handles. KeWait... and ZwXyzFile
    > are very particular about what form of synchronization "object" you
    > pass.
    >
    > As far as I know, KeWaitForSingleObject() only works on pointers to
    > structs that start with a DISPATCHER_HEADER struct, such as KEVENT.
    > You cannot use any sort of handle (it's not a pointer to a struct),
    > and I imagine you cannot use a FILE_OBJECT pointer because it doesn't
    > start with a DISPATCHER_HEADER.
    >
    > On the other hand, the "event" you pass to ZwReadFile() MUST
    > be a handle
    > to an event, not a pointer to a KEVENT you've set up with
    > KeInitializeEvent().
    >
    > If you have a handle (event or file-object) and want to wait on it,
    > try ZwWaitForSingleObject(), and its kindred, which are documented in
    > Nebbett's Native API Reference, but not in the DDK. These work on
    > handles, not DISPATCHER_HEADER structs. ZwWaitForSingleObject() is
    > prototyped in NTIFS.H.
    >
    > --------------------------------------------------------------
    > ---------
    > Dave Cox
    > Hewlett-Packard Co.
    > HPSO/SSMO (Santa Barbara)
    > https://ecardfile.com/id/Dave+Cox
    >
    >
    > -----Original Message-----
    > From: david c. steere [mailto:[email protected]]
    > Sent: Monday, May 08, 2000 9:18 PM
    > To: File Systems Developers
    > Subject: [ntfsd] RE: YASQ
    >
    >
    > I've tried waiting in 2 different ways:
    > - KeWait... on a handle returned from ZwCreateFile
    > and on a file
    > object
    > - passing an event (alloc'd from the nonpaged pool
    > and initialized
    > via KeInitEvent()) to ZwReadFile, and waiting on it with KeWait...
    >
    > The first method failed in a BSOD, either on the wait or
    > later (when the
    > process exited). The second method failed because ZwReadFile
    > returned an
    > error (invalid handle). I have successfully used events, some
    > that were
    > allocated in the non-paged pool and some that were part of the device
    > extension (which is non-paged). Several people have mentioned
    > waiting on a
    > file object but I've yet been able to successfully do it.
    >
    > david.
    >
    >
    > At 03:42 PM 5/8/00 -0600, you wrote:
    > >KeWait... doesn't operate on handles. You need to reference the
    > >handle to get an object pointer.
    > >
    > >How are you getting a handle to the event you create?
    > >KeInitializeEvent() operates on nonpaged pool memory to
    > create a valid
    > >KEVENT object, but not a handle.
    > >
    > >-------------------------------------------------------------
    > ----------
    > >Dave Cox
    > >Hewlett-Packard Co.
    > >HPSO/SSMO (Santa Barbara)
    > >https://ecardfile.com/id/Dave+Cox
    > >
    > >
    > >-----Original Message-----
    > >From: david c. steere [mailto:[email protected]]
    > >Sent: Monday, May 08, 2000 2:04 PM
    > >To: File Systems Developers
    > >Subject: [ntfsd] YASQ
    > >
    > >
    > >Yet another stupid question...
    > >
    > >I've been having a heck of a time with blocking user
    > requests. I tracked a
    > >BSOD problem I was having to calling KeWaitForSingleObject
    > with a KEVENT
    > >allocated in the paged pool. However, I'm now stuck trying to block a
    > thread
    > >for the completion of a pending read via ZwReadFile().
    > >
    > >The NT4 DDK docs say you can wait on a HANDLE returned by
    > ZwCreateFile()
    > (if
    > >you specify the SYNCHRONIZE flag). Being somewhat naive, I
    > tried doing just
    > >that but I get a BSOD when I call KeWaitForSingleObject on
    > the handle.
    > >Alternatively, I can create an event (in non-paged memory of
    > course) but
    > >when I pass it into ZwReadFile (as the 2nd argument) I get a
    > >STATUS_INVALID_HANDLE.
    > >
    > >So, the question is how does one go about waiting on handles or file
    > objects
    > >if they aren't allocated as non-paged? Or, how does one
    > create an event
    > that
    > >can be passed to ZwReadFile?
    > >
    > >thanks,
    > >
    > >david
    > >
    > >ps, seems like there have been lots of dispatcher-object
    > related questions
    > >on this list of late. Is there something I should read that
    > would make this
    > >all clear to me? (I've read bits of DDK documentation in MSDN, Inside
    > WinNT,
    > >the OSR driver book, and Nagar's FS book.)
    > >
    > >
    > >---
    > >You are currently subscribed to ntfsd as: david_co[email protected]
    > >To unsubscribe send a blank email to $subst('Email.Unsub')
    > >
    > >---
    > >You are currently subscribed to ntfsd as: [email protected]
    > >To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
    >
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Seems like every answer raises more questions in my poor, confused head...

    At 11:41 AM 5/15/00 -0500, you wrote:
    >Actually, you can wait on a file object. However, if you're using the
    >KeWait family, you must wait on &FileObject->Event, not on FileObject. You
    >can use file handles with the ZwWait family as well.

    FileObject->Event is a KEVENT, not a PKEVENT I believe. Are FILE_OBJECTs allocated in non-paged memory? If not, wouldn't using this event cause a BSOD? (I was getting BSOD when I tried this, although I can't verify that use of fileObject->Event was the cause).


    >In general, waiting on a file object isn't terribly useful. If the file is
    >opened for asynchronous IO (overlapped,) then you cannot be sure which
    >read/write operation completed if multiple operations were initiated. If
    >the file is opened for synchronous IO, then the requesting thread will block
    >until the operation is complete.

    Yeah, I was wondering about this too. Currently I create an event for each outstanding request using IoCreateSynchronizationEvent(). However, I have to pass a name into IoCreateSyncEvent and that name has to be unique so that when a request is awoken it can assume the I/O for which it was waiting has completed. Is there a way to determine if the I/O is done (query IoStatus perhaps?). Alternatively, is there a good way to get a unique string? (I considered using the current time or the current stack pointer as the name. It'd be nice if you could create unnamed event objects).

    Thanks!

    david.

    > > -----Original Message-----
    > > From: COX,DAVID (HP-Roseville,ex1) [mailto:[email protected]]
    > > Sent: Wednesday, May 10, 2000 12:58 PM
    > > To: File Systems Developers
    > > Subject: [ntfsd] RE: YASQ
    > >
    > >
    > > Again, it sounds like you are mixing too freely simple structs, true
    > > Object Manager objects, and object handles. KeWait... and ZwXyzFile
    > > are very particular about what form of synchronization "object" you
    > > pass.
    > >
    > > As far as I know, KeWaitForSingleObject() only works on pointers to
    > > structs that start with a DISPATCHER_HEADER struct, such as KEVENT.
    > > You cannot use any sort of handle (it's not a pointer to a struct),
    > > and I imagine you cannot use a FILE_OBJECT pointer because it doesn't
    > > start with a DISPATCHER_HEADER.
    > >
    > > On the other hand, the "event" you pass to ZwReadFile() MUST
    > > be a handle
    > > to an event, not a pointer to a KEVENT you've set up with
    > > KeInitializeEvent().
    > >
    > > If you have a handle (event or file-object) and want to wait on it,
    > > try ZwWaitForSingleObject(), and its kindred, which are documented in
    > > Nebbett's Native API Reference, but not in the DDK. These work on
    > > handles, not DISPATCHER_HEADER structs. ZwWaitForSingleObject() is
    > > prototyped in NTIFS.H.
    > >
    > > --------------------------------------------------------------
    > > ---------
    > > Dave Cox
    > > Hewlett-Packard Co.
    > > HPSO/SSMO (Santa Barbara)
    > > https://ecardfile.com/id/Dave+Cox
    > >
    > >
    > > -----Original Message-----
    > > From: david c. steere [mailto:[email protected]]
    > > Sent: Monday, May 08, 2000 9:18 PM
    > > To: File Systems Developers
    > > Subject: [ntfsd] RE: YASQ
    > >
    > >
    > > I've tried waiting in 2 different ways:
    > > - KeWait... on a handle returned from ZwCreateFile
    > > and on a file
    > > object
    > > - passing an event (alloc'd from the nonpaged pool
    > > and initialized
    > > via KeInitEvent()) to ZwReadFile, and waiting on it with KeWait...
    > >
    > > The first method failed in a BSOD, either on the wait or
    > > later (when the
    > > process exited). The second method failed because ZwReadFile
    > > returned an
    > > error (invalid handle). I have successfully used events, some
    > > that were
    > > allocated in the non-paged pool and some that were part of the device
    > > extension (which is non-paged). Several people have mentioned
    > > waiting on a
    > > file object but I've yet been able to successfully do it.
    > >
    > > david.
    > >
    > >
    > > At 03:42 PM 5/8/00 -0600, you wrote:
    > > >KeWait... doesn't operate on handles. You need to reference the
    > > >handle to get an object pointer.
    > > >
    > > >How are you getting a handle to the event you create?
    > > >KeInitializeEvent() operates on nonpaged pool memory to
    > > create a valid
    > > >KEVENT object, but not a handle.
    > > >
    > > >-------------------------------------------------------------
    > > ----------
    > > >Dave Cox
    > > >Hewlett-Packard Co.
    > > >HPSO/SSMO (Santa Barbara)
    > > >https://ecardfile.com/id/Dave+Cox
    > > >
    > > >
    > > >-----Original Message-----
    > > >From: david c. steere [mailto:[email protected]]
    > > >Sent: Monday, May 08, 2000 2:04 PM
    > > >To: File Systems Developers
    > > >Subject: [ntfsd] YASQ
    > > >
    > > >
    > > >Yet another stupid question...
    > > >
    > > >I've been having a heck of a time with blocking user
    > > requests. I tracked a
    > > >BSOD problem I was having to calling KeWaitForSingleObject
    > > with a KEVENT
    > > >allocated in the paged pool. However, I'm now stuck trying to block a
    > > thread
    > > >for the completion of a pending read via ZwReadFile().
    > > >
    > > >The NT4 DDK docs say you can wait on a HANDLE returned by
    > > ZwCreateFile()
    > > (if
    > > >you specify the SYNCHRONIZE flag). Being somewhat naive, I
    > > tried doing just
    > > >that but I get a BSOD when I call KeWaitForSingleObject on
    > > the handle.
    > > >Alternatively, I can create an event (in non-paged memory of
    > > course) but
    > > >when I pass it into ZwReadFile (as the 2nd argument) I get a
    > > >STATUS_INVALID_HANDLE.
    > > >
    > > >So, the question is how does one go about waiting on handles or file
    > > objects
    > > >if they aren't allocated as non-paged? Or, how does one
    > > create an event
    > > that
    > > >can be passed to ZwReadFile?
    > > >
    > > >thanks,
    > > >
    > > >david
    > > >
    > > >ps, seems like there have been lots of dispatcher-object
    > > related questions
    > > >on this list of late. Is there something I should read that
    > > would make this
    > > >all clear to me? (I've read bits of DDK documentation in MSDN, Inside
    > > WinNT,
    > > >the OSR driver book, and Nagar's FS book.)
    > > >
    > > >
    > > >---
    > > >You are currently subscribed to ntfsd as: [email protected]
    > > >To unsubscribe send a blank email to $subst('Email.Unsub')
    > > >
    > > >---
    > > >You are currently subscribed to ntfsd as: [email protected]
    > > >To unsubscribe send a blank email to $subst('Email.Unsub')
    > >
    > >
    > > ---
    > > You are currently subscribed to ntfsd as: [email protected]
    > > To unsubscribe send a blank email to $subst('Email.Unsub')
    > >
    > > ---
    > > You are currently subscribed to ntfsd as: [email protected]
    > > To unsubscribe send a blank email to $subst('Email.Unsub')
    > >
    >
    >---
    >You are currently subscribed to ntfsd as: [email protected]
    >To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    FileObject->Event is really KEVENT - this is logical
    there must be event object body stored right in the file object.
    File objects are really allocated from non-paged memory so
    using this event cannot couse BSOD - Event is initialized at
    file object creation and is valid till the file object exist.

    IoCreateSynchronizationEvent or IoCreateNotificationEvent
    creates named event object (by using ZwCreateEvent).
    This is not need in your case. You should simply declare
    local (stack) variable of type KEVENT and initialize it
    using KeInitializeEvent. Then use this event to associate it
    with irp you are passing to the driver and in the case of
    STATUS_PENDING is returned wait on this event using
    KeWaitForSingleObject.

    Code would look like this:
    IO_STATUS_BLOCK IoStatus;
    KEVENT Event;
    NTSTATUS Status;
    PIRP Irp;
    ...
    KeInitializeEvent(&Event, SynchronizationEvent, FALSE);
    ...
    Irp = IoBuildSynchronousFsdRequest(..., &Event, ...);
    ...
    Status = IoCallDriver(..., Irp);
    if (Status == STATUS_PENDING)
    {
    Status = KeWaitForSingleObject(&Event, ..., FALSE, NULL);
    ASSERT(Status == STATUS_WAIT_0);
    Status = IoStatus.Status;
    }
    ...

    The way for determining if the I/O is done is to query the event
    using KeReadStateEvent (non-zero means Signalled - I/O is done).
    Another way to resolve I/O synchronization problems is
    using Asynchronous Procedure Call. There is a field in
    the IRP called UserApcRoutine (and UserApcContext)
    (in Overlay.AsynchronousParameters).
    If you want to know more about this method please let me know.


    Paul

    > Seems like every answer raises more questions in my poor, confused head...
    >
    > At 11:41 AM 5/15/00 -0500, you wrote:
    > >Actually, you can wait on a file object. However, if you're using the
    > >KeWait family, you must wait on &FileObject->Event, not on FileObject.
    > You
    > >can use file handles with the ZwWait family as well.
    >
    > FileObject->Event is a KEVENT, not a PKEVENT I believe. Are FILE_OBJECTs
    > allocated in non-paged memory? If not, wouldn't using this event cause a
    > BSOD? (I was getting BSOD when I tried this, although I can't verify that
    > use of fileObject->Event was the cause).
    >
    >
    > >In general, waiting on a file object isn't terribly useful. If the file
    > is
    > >opened for asynchronous IO (overlapped,) then you cannot be sure which
    > >read/write operation completed if multiple operations were initiated. If
    > >the file is opened for synchronous IO, then the requesting thread will
    > block
    > >until the operation is complete.
    >
    > Yeah, I was wondering about this too. Currently I create an event for each
    > outstanding request using IoCreateSynchronizationEvent(). However, I have
    > to pass a name into IoCreateSyncEvent and that name has to be unique so
    > that when a request is awoken it can assume the I/O for which it was
    > waiting has completed. Is there a way to determine if the I/O is done
    > (query IoStatus perhaps?). Alternatively, is there a good way to get a
    > unique string? (I considered using the current time or the current stack
    > pointer as the name. It'd be nice if you could create unnamed event
    > objects).
    >
    > Thanks!
    >
    > david.
    >
    > > > -----Original Message-----
    > > > From: COX,DAVID (HP-Roseville,ex1) [mailto:[email protected]]
    > > > Sent: Wednesday, May 10, 2000 12:58 PM
    > > > To: File Systems Developers
    > > > Subject: [ntfsd] RE: YASQ
    > > >
    > > >
    > > > Again, it sounds like you are mixing too freely simple structs, true
    > > > Object Manager objects, and object handles. KeWait... and ZwXyzFile
    > > > are very particular about what form of synchronization "object" you
    > > > pass.
    > > >
    > > > As far as I know, KeWaitForSingleObject() only works on pointers to
    > > > structs that start with a DISPATCHER_HEADER struct, such as KEVENT.
    > > > You cannot use any sort of handle (it's not a pointer to a struct),
    > > > and I imagine you cannot use a FILE_OBJECT pointer because it doesn't
    > > > start with a DISPATCHER_HEADER.
    > > >
    > > > On the other hand, the "event" you pass to ZwReadFile() MUST
    > > > be a handle
    > > > to an event, not a pointer to a KEVENT you've set up with
    > > > KeInitializeEvent().
    > > >
    > > > If you have a handle (event or file-object) and want to wait on it,
    > > > try ZwWaitForSingleObject(), and its kindred, which are documented in
    > > > Nebbett's Native API Reference, but not in the DDK. These work on
    > > > handles, not DISPATCHER_HEADER structs. ZwWaitForSingleObject() is
    > > > prototyped in NTIFS.H.
    > > >
    > > > --------------------------------------------------------------
    > > > ---------
    > > > Dave Cox
    > > > Hewlett-Packard Co.
    > > > HPSO/SSMO (Santa Barbara)
    > > > https://ecardfile.com/id/Dave+Cox
    > > >
    > > >
    > > > -----Original Message-----
    > > > From: david c. steere [mailto:[email protected]]
    > > > Sent: Monday, May 08, 2000 9:18 PM
    > > > To: File Systems Developers
    > > > Subject: [ntfsd] RE: YASQ
    > > >
    > > >
    > > > I've tried waiting in 2 different ways:
    > > > - KeWait... on a handle returned from ZwCreateFile
    > > > and on a file
    > > > object
    > > > - passing an event (alloc'd from the nonpaged pool
    > > > and initialized
    > > > via KeInitEvent()) to ZwReadFile, and waiting on it with KeWait...
    > > >
    > > > The first method failed in a BSOD, either on the wait or
    > > > later (when the
    > > > process exited). The second method failed because ZwReadFile
    > > > returned an
    > > > error (invalid handle). I have successfully used events, some
    > > > that were
    > > > allocated in the non-paged pool and some that were part of the device
    > > > extension (which is non-paged). Several people have mentioned
    > > > waiting on a
    > > > file object but I've yet been able to successfully do it.
    > > >
    > > > david.
    > > >
    > > >
    > > > At 03:42 PM 5/8/00 -0600, you wrote:
    > > > >KeWait... doesn't operate on handles. You need to reference the
    > > > >handle to get an object pointer.
    > > > >
    > > > >How are you getting a handle to the event you create?
    > > > >KeInitializeEvent() operates on nonpaged pool memory to
    > > > create a valid
    > > > >KEVENT object, but not a handle.
    > > > >
    > > > >-------------------------------------------------------------
    > > > ----------
    > > > >Dave Cox
    > > > >Hewlett-Packard Co.
    > > > >HPSO/SSMO (Santa Barbara)
    > > > >https://ecardfile.com/id/Dave+Cox
    > > > >
    > > > >
    > > > >-----Original Message-----
    > > > >From: david c. steere [mailto:[email protected]]
    > > > >Sent: Monday, May 08, 2000 2:04 PM
    > > > >To: File Systems Developers
    > > > >Subject: [ntfsd] YASQ
    > > > >
    > > > >
    > > > >Yet another stupid question...
    > > > >
    > > > >I've been having a heck of a time with blocking user
    > > > requests. I tracked a
    > > > >BSOD problem I was having to calling KeWaitForSingleObject
    > > > with a KEVENT
    > > > >allocated in the paged pool. However, I'm now stuck trying to block a
    > > > thread
    > > > >for the completion of a pending read via ZwReadFile().
    > > > >
    > > > >The NT4 DDK docs say you can wait on a HANDLE returned by
    > > > ZwCreateFile()
    > > > (if
    > > > >you specify the SYNCHRONIZE flag). Being somewhat naive, I
    > > > tried doing just
    > > > >that but I get a BSOD when I call KeWaitForSingleObject on
    > > > the handle.
    > > > >Alternatively, I can create an event (in non-paged memory of
    > > > course) but
    > > > >when I pass it into ZwReadFile (as the 2nd argument) I get a
    > > > >STATUS_INVALID_HANDLE.
    > > > >
    > > > >So, the question is how does one go about waiting on handles or file
    > > > objects
    > > > >if they aren't allocated as non-paged? Or, how does one
    > > > create an event
    > > > that
    > > > >can be passed to ZwReadFile?
    > > > >
    > > > >thanks,
    > > > >
    > > > >david
    > > > >
    > > > >ps, seems like there have been lots of dispatcher-object
    > > > related questions
    > > > >on this list of late. Is there something I should read that
    > > > would make this
    > > > >all clear to me? (I've read bits of DDK documentation in MSDN, Inside
    > > > WinNT,
    > > > >the OSR driver book, and Nagar's FS book.)
    > > > >
    > > > >
    > > > >---
    > > > >You are currently subscribed to ntfsd as: [email protected]
    > > > >To unsubscribe send a blank email to $subst('Email.Unsub')
    > > > >
    > > > >---
    > > > >You are currently subscribed to ntfsd as: [email protected]
    > > > >To unsubscribe send a blank email to $subst('Email.Unsub')
    > > >
    > > >
    > > > ---
    > > > You are currently subscribed to ntfsd as: [email protected]
    > > > To unsubscribe send a blank email to $subst('Email.Unsub')
    > > >
    > > > ---
    > > > You are currently subscribed to ntfsd as: [email protected]
    > > > To unsubscribe send a blank email to $subst('Email.Unsub')
    > > >
    > >
    > >---
    > >You are currently subscribed to ntfsd as: [email protected]
    > >To unsubscribe send a blank email to $subst('Email.Unsub')
    >
    >
    > ---
    > You are currently subscribed to ntfsd as: [email protected]
    > To unsubscribe send a blank email to $subst('Email.Unsub')
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    > FileObject->Event is a KEVENT, not a PKEVENT I believe. Are FILE_OBJECTs
    allocated in non-paged memory? If not, wouldn't using this

    Surely.

    Max
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE