Efficient kernel-to-user-space communication

NTDEV
1

Hello,

I have a legacy driver that needs to communicate to my service both
synchronously, and asynchronously. I’ve been using the upcall
approach for this communication, but I feel like there should be a
better approach :slight_smile: I remember there was an article on it somewhere,
but I’ve been unable to locate it. Is there a more accepted approach
for communication than using upcalls?

thanks! :slight_smile:

2

I’ve never seen an “upcall” in windows, but I suspect you are thinking
about inverted calls, see http://www.osronline.com/article.cfm?id=94 for
a good article on the model.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: Jonathon [mailto:xxxxx@gmail.com]
Posted At: Thursday, May 27, 2010 7:43 PM
Posted To: ntdev
Conversation: Efficient kernel-to-user-space communication
Subject: Efficient kernel-to-user-space communication

Hello,

I have a legacy driver that needs to communicate to my service both
synchronously, and asynchronously. I’ve been using the upcall
approach for
this communication, but I feel like there should be a better approach
:slight_smile: I
remember there was an article on it somewhere, but I’ve been unable to
locate
it. Is there a more accepted approach for communication than using
upcalls?

thanks! :slight_smile:

__________ Information from ESET Smart Security, version of virus
signature
database 5151 (20100527) __________

The message was checked by ESET Smart Security.

http://www.eset.com

3

Thanks Don! That’s the article I was looking for :slight_smile:

On Thu, May 27, 2010 at 4:48 PM, Don Burn wrote:
> I’ve never seen an “upcall” in windows, but I suspect you are thinking
> about inverted calls, see http://www.osronline.com/article.cfm?id=94 for
> a good article on the model.
>
>
> Don Burn (MVP, Windows DKD)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
>
>> -----Original Message-----
>> From: Jonathon [mailto:xxxxx@gmail.com]
>> Posted At: Thursday, May 27, 2010 7:43 PM
>> Posted To: ntdev
>> Conversation: Efficient kernel-to-user-space communication
>> Subject: Efficient kernel-to-user-space communication
>>
>> Hello,
>>
>> I have a legacy driver that needs to communicate to my service both
>> synchronously, and asynchronously. ?I’ve been using the upcall
> approach for
>> this communication, but I feel like there should be a better approach
> :slight_smile: I
>> remember there was an article on it somewhere, but I’ve been unable to
> locate
>> it. Is there a more accepted approach for communication than using
> upcalls?
>>
>> thanks! :slight_smile:
>>
>>
>> Information from ESET Smart Security, version of virus
> signature
>> database 5151 (20100527)
>>
>> The message was checked by ESET Smart Security.
>>
>> http://www.eset.com
>>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

4

One issue I am experiencing, is that when my service sends down the
IOCTLs in preparation for the inverted calls and the service
unexpectedly crashes, those IOCTLs are not being “reclaimed”. I was
hoping there was a way to use sockets to communicate between kernel
and user-space so that if the service crashes, it can just reconnect
to the driver and everything is good :slight_smile: I’ve tried googling for this
connection-based communication mechanism in the kernel and it seems
that it only exists in filesystem filter drivers, whereas my driver is
a standard legacy driver. :frowning:

Thanks

On Thu, May 27, 2010 at 5:19 PM, Jonathon wrote:
> Thanks Don! That’s the article I was looking for :slight_smile:
>
> On Thu, May 27, 2010 at 4:48 PM, Don Burn wrote:
>> I’ve never seen an “upcall” in windows, but I suspect you are thinking
>> about inverted calls, see http://www.osronline.com/article.cfm?id=94 for
>> a good article on the model.
>>
>>
>> Don Burn (MVP, Windows DKD)
>> Windows Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/WinDrvr
>>
>>
>>
>>
>>> -----Original Message-----
>>> From: Jonathon [mailto:xxxxx@gmail.com]
>>> Posted At: Thursday, May 27, 2010 7:43 PM
>>> Posted To: ntdev
>>> Conversation: Efficient kernel-to-user-space communication
>>> Subject: Efficient kernel-to-user-space communication
>>>
>>> Hello,
>>>
>>> I have a legacy driver that needs to communicate to my service both
>>> synchronously, and asynchronously. ?I’ve been using the upcall
>> approach for
>>> this communication, but I feel like there should be a better approach
>> :slight_smile: I
>>> remember there was an article on it somewhere, but I’ve been unable to
>> locate
>>> it. Is there a more accepted approach for communication than using
>> upcalls?
>>>
>>> thanks! :slight_smile:
>>>
>>>
>>> Information from ESET Smart Security, version of virus
>> signature
>>> database 5151 (20100527)
>>>
>>> The message was checked by ESET Smart Security.
>>>
>>> http://www.eset.com
>>>
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>>
>

5

If your service is a standalone process, and it crashes, all ioctls
will be automatically canceled, so your driver won’t miss this.
But if your service lives in a shared host process, there is a problem.
– pa

“Jonathon” wrote in message news:xxxxx@ntdev…
> One issue I am experiencing, is that when my service sends down the
> IOCTLs in preparation for the inverted calls and the service
> unexpectedly crashes, those IOCTLs are not being “reclaimed”. I was
> hoping there was a way to use sockets to communicate between kernel
> and user-space so that if the service crashes, it can just reconnect
> to the driver and everything is good :slight_smile: I’ve tried googling for this
> connection-based communication mechanism in the kernel and it seems
> that it only exists in filesystem filter drivers, whereas my driver is
> a standard legacy driver. :frowning:
>
> Thanks
>
> On Thu, May 27, 2010 at 5:19 PM, Jonathon wrote:
>> Thanks Don! That’s the article I was looking for :slight_smile:
>>
>> On Thu, May 27, 2010 at 4:48 PM, Don Burn wrote:
>>> I’ve never seen an “upcall” in windows, but I suspect you are thinking
>>> about inverted calls, see http://www.osronline.com/article.cfm?id=94 for
>>> a good article on the model.
>>>
>>>
>>> Don Burn (MVP, Windows DKD)
>>> Windows Filesystem and Driver Consulting
>>> Website: http://www.windrvr.com
>>> Blog: http://msmvps.com/blogs/WinDrvr
>>>
>>>
>>>
>>>
>>>> -----Original Message-----
>>>> From: Jonathon [mailto:xxxxx@gmail.com]
>>>> Posted At: Thursday, May 27, 2010 7:43 PM
>>>> Posted To: ntdev
>>>> Conversation: Efficient kernel-to-user-space communication
>>>> Subject: Efficient kernel-to-user-space communication
>>>>
>>>> Hello,
>>>>
>>>> I have a legacy driver that needs to communicate to my service both
>>>> synchronously, and asynchronously. I’ve been using the upcall
>>> approach for
>>>> this communication, but I feel like there should be a better approach
>>> :slight_smile: I
>>>> remember there was an article on it somewhere, but I’ve been unable to
>>> locate
>>>> it. Is there a more accepted approach for communication than using
>>> upcalls?
>>>>
>>>> thanks! :slight_smile:
>>>>
>>>>
>>>> Information from ESET Smart Security, version of virus
>>> signature
>>>> database 5151 (20100527)
>>>>
>>>> The message was checked by ESET Smart Security.
>>>>
>>>> http://www.eset.com
>>>>
>>>
>>>
>>> —
>>> NTDEV is sponsored by OSR
>>>
>>> For our schedule of WDF, WDM, debugging and other seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>>
>>
>

6

Are you setting a cancel routine or putting these requests into a cancel safe queue (IOCSQ) ? if possible (and assumning you are not using kmdf) use the iocsq. You need to set the cancel routine so that the process can cancel requests and when it crashes, the OS can cancel them.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jonathon
Sent: Friday, May 28, 2010 9:04 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Efficient kernel-to-user-space communication

One issue I am experiencing, is that when my service sends down the IOCTLs in preparation for the inverted calls and the service unexpectedly crashes, those IOCTLs are not being “reclaimed”. I was hoping there was a way to use sockets to communicate between kernel and user-space so that if the service crashes, it can just reconnect to the driver and everything is good :slight_smile: I’ve tried googling for this connection-based communication mechanism in the kernel and it seems that it only exists in filesystem filter drivers, whereas my driver is a standard legacy driver. :frowning:

Thanks

On Thu, May 27, 2010 at 5:19 PM, Jonathon wrote:
> Thanks Don! That’s the article I was looking for :slight_smile:
>
> On Thu, May 27, 2010 at 4:48 PM, Don Burn wrote:
>> I’ve never seen an “upcall” in windows, but I suspect you are
>> thinking about inverted calls, see
>> http://www.osronline.com/article.cfm?id=94 for a good article on the model.
>>
>>
>> Don Burn (MVP, Windows DKD)
>> Windows Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/WinDrvr
>>
>>
>>
>>
>>> -----Original Message-----
>>> From: Jonathon [mailto:xxxxx@gmail.com] Posted At: Thursday,
>>> May 27, 2010 7:43 PM Posted To: ntdev
>>> Conversation: Efficient kernel-to-user-space communication
>>> Subject: Efficient kernel-to-user-space communication
>>>
>>> Hello,
>>>
>>> I have a legacy driver that needs to communicate to my service both
>>> synchronously, and asynchronously. ?I’ve been using the upcall
>> approach for
>>> this communication, but I feel like there should be a better
>>> approach
>> :slight_smile: I
>>> remember there was an article on it somewhere, but I’ve been unable
>>> to
>> locate
>>> it. Is there a more accepted approach for communication than using
>> upcalls?
>>>
>>> thanks! :slight_smile:
>>>
>>>
>>> Information from ESET Smart Security, version of virus
>> signature
>>> database 5151 (20100527)
>>>
>>> The message was checked by ESET Smart Security.
>>>
>>> http://www.eset.com
>>>
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

7

>unexpectedly crashes, those IOCTLs are not being “reclaimed”.

Support cancellation for them.

hoping there was a way to use sockets to communicate between kernel

So that the Windows Firewall settings can break your product???

Note that with FltMgr, you also have its ports, which are very good.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com