How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

NTDEV
1

hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the user buffer is being described by a MDL (irp->MdlAddress) that is passed to my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb driver (driver #1) passes the irp->MdlAddress to another driver (driver #2) via a via an internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the “OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER, FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find where the user buffer by looking for the original irp->MdlAddress address, was but had no luck finding it.

Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl to another driver so that it can fill the corresponding output buffer?

If possible, please specify how to do it, including whether or not I need to call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

2

Can you define " … by looking for the original irp->MdlAddress address,
was but had no luck finding it."? How are you passing/inspecting the IRP?

–
Jonathan Morrison
“S. Drasnin” wrote in message news:xxxxx@ntdev…
hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the
user buffer is being described by a MDL (irp->MdlAddress) that is passed to
my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb driver (driver
#1) passes the irp->MdlAddress to another driver (driver #2) via a via an
internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling
IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the
“OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER,
FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find where the user
buffer by looking for the original irp->MdlAddress address, was but had no
luck finding it.

Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl
to another driver so that it can fill the corresponding output buffer?

If possible, please specify how to do it, including whether or not I need to
call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

3

hi

Thanks for the response. I was using windbg to examine the IRP structure when I got to the IRP_MJ_INTERNAL_DEVICE_CONTROL handler in driver #2.

By the way, I came up with a work around since it appears that an internal device I/O control call (IoBuildDeviceIoControlRequest with IRP_MJ_INTERNAL_DEVICE_CONTROL) messes with the input and output buffer pointers passed to it - it tries to fix up the address (I would guess) and maybe you’re not supposed to pass a mdl pointer.

The work-around I did was to pass the Mdl pointer inside the input buffer (so that the OS wouldn’t mess with it) rather than passing it directly as the output buffer pointer. (Note that I did call MmGetSystemAddressForMdlSafe in driver #1 before calling IoBuildDeviceIoControlRequest.) Now I’m able to write data to that buffer and it gets returned OK to driver #1 and finally back to the application that did the original ReadFile() call. Before it crashed all the time for a particular test case of mine.

If you happen to know what the OS does to the input and output pointers you pass via a internal device I/O control call for the different types of accesses (METHOD_NEITHER, METHOD_BUFFERED, etc.) and any restrictions (such as not passing MDL pointers). I would love to know, though since I couldn’t find any meaty documentation on it.

thanks
sharon

----- Original Message -----
From: Jonathan Morrison [Microsoft]
Newsgroups: ntdev
To: Windows System Software Devs Interest List
Sent: Tuesday, June 21, 2005 12:14 PM
Subject: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

Can you define " … by looking for the original irp->MdlAddress address,
was but had no luck finding it."? How are you passing/inspecting the IRP?

–
Jonathan Morrison
“S. Drasnin” wrote in message news:xxxxx@ntdev…
hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the
user buffer is being described by a MDL (irp->MdlAddress) that is passed to
my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb driver (driver
#1) passes the irp->MdlAddress to another driver (driver #2) via a via an
internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling
IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the
“OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER,
FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find where the user
buffer by looking for the original irp->MdlAddress address, was but had no
luck finding it.

Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl
to another driver so that it can fill the corresponding output buffer?

If possible, please specify how to do it, including whether or not I need to
call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@msn.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

ugh.

allocate and irp using IoAllocateIrp, setup the next IRP stack location
yourself, and send it directly to the lower driver. Don’t bother with
IoBuildDeviceIoControlRequest in this case since it’s not doing what you
need.

-p

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of S. Drasnin
Sent: Tuesday, June 21, 2005 7:54 PM
To: Windows System Software Devs Interest List
Subject: Re: Re:[ntdev] How do you pass a Mdl pointer to another driver
via IoBuildDeviceIoControlRequest?

hi

Thanks for the response. I was using windbg to examine the IRP
structure when I got to the IRP_MJ_INTERNAL_DEVICE_CONTROL handler in
driver #2.

By the way, I came up with a work around since it appears that an
internal device I/O control call (IoBuildDeviceIoControlRequest with
IRP_MJ_INTERNAL_DEVICE_CONTROL) messes with the input and output buffer
pointers passed to it - it tries to fix up the address (I would guess)
and maybe you’re not supposed to pass a mdl pointer.

The work-around I did was to pass the Mdl pointer inside the input
buffer (so that the OS wouldn’t mess with it) rather than passing it
directly as the output buffer pointer. (Note that I did call
MmGetSystemAddressForMdlSafe in driver #1 before calling
IoBuildDeviceIoControlRequest.) Now I’m able to write data to that
buffer and it gets returned OK to driver #1 and finally back to the
application that did the original ReadFile() call. Before it crashed all
the time for a particular test case of mine.

If you happen to know what the OS does to the input and output pointers
you pass via a internal device I/O control call for the different types
of accesses (METHOD_NEITHER, METHOD_BUFFERED, etc.) and any restrictions
(such as not passing MDL pointers). I would love to know, though since I
couldn’t find any meaty documentation on it.

thanks
sharon

----- Original Message -----
From: Jonathan Morrison [Microsoft]
mailto:xxxxx
Newsgroups: ntdev
To: Windows System Software Devs Interest List
mailto:xxxxx
Sent: Tuesday, June 21, 2005 12:14 PM
Subject: Re:[ntdev] How do you pass a Mdl pointer to another
driver via IoBuildDeviceIoControlRequest?

Can you define " … by looking for the original irp->MdlAddress
address,
was but had no luck finding it."? How are you passing/inspecting
the IRP?

–
Jonathan Morrison
“S. Drasnin” wrote in message
news:xxxxx@ntdev…
hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for
ReadFile, the
user buffer is being described by a MDL (irp->MdlAddress) that
is passed to
my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb
driver (driver
#1) passes the irp->MdlAddress to another driver (driver #2) via
a via an
internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by
calling
IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the

“OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4,
METHOD_NEITHER,
FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find
where the user
buffer by looking for the original irp->MdlAddress address, was
but had no
luck finding it.

Can somebody tell me if it possible to do what I’m trying to do:
pass a pMdl
to another driver so that it can fill the corresponding output
buffer?

If possible, please specify how to do it, including whether or
not I need to
call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@msn.com
To unsubscribe send a blank email to
xxxxx@listsosr.com mailto:xxxxx

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>

5

thanks for the helpful info - your method is obviously cleaner - I was just happy to figure out something that worked / didn’t BSOD.

Out of curiosity though, I’d still like to know what is happening under the covers for IoBuildDeviceIoControl request for the buffer pointer parameters. Wish I had OS source code to step through…

----- Original Message -----
From: Peter Wieland
To: Windows System Software Devs Interest List
Sent: Tuesday, June 21, 2005 8:01 PM
Subject: RE: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

ugh.

allocate and irp using IoAllocateIrp, setup the next IRP stack location yourself, and send it directly to the lower driver. Don’t bother with IoBuildDeviceIoControlRequest in this case since it’s not doing what you need.

-p

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of S. Drasnin
Sent: Tuesday, June 21, 2005 7:54 PM
To: Windows System Software Devs Interest List
Subject: Re: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

hi

Thanks for the response. I was using windbg to examine the IRP structure when I got to the IRP_MJ_INTERNAL_DEVICE_CONTROL handler in driver #2.

By the way, I came up with a work around since it appears that an internal device I/O control call (IoBuildDeviceIoControlRequest with IRP_MJ_INTERNAL_DEVICE_CONTROL) messes with the input and output buffer pointers passed to it - it tries to fix up the address (I would guess) and maybe you’re not supposed to pass a mdl pointer.

The work-around I did was to pass the Mdl pointer inside the input buffer (so that the OS wouldn’t mess with it) rather than passing it directly as the output buffer pointer. (Note that I did call MmGetSystemAddressForMdlSafe in driver #1 before calling IoBuildDeviceIoControlRequest.) Now I’m able to write data to that buffer and it gets returned OK to driver #1 and finally back to the application that did the original ReadFile() call. Before it crashed all the time for a particular test case of mine.

If you happen to know what the OS does to the input and output pointers you pass via a internal device I/O control call for the different types of accesses (METHOD_NEITHER, METHOD_BUFFERED, etc.) and any restrictions (such as not passing MDL pointers). I would love to know, though since I couldn’t find any meaty documentation on it.

thanks
sharon

----- Original Message -----
From: Jonathan Morrison [Microsoft]
Newsgroups: ntdev
To: Windows System Software Devs Interest List
Sent: Tuesday, June 21, 2005 12:14 PM
Subject: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

Can you define " … by looking for the original irp->MdlAddress address,
was but had no luck finding it."? How are you passing/inspecting the IRP?

–
Jonathan Morrison
“S. Drasnin” wrote in message news:xxxxx@ntdev…
hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the
user buffer is being described by a MDL (irp->MdlAddress) that is passed to
my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb driver (driver
#1) passes the irp->MdlAddress to another driver (driver #2) via a via an
internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling
IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the
“OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER,
FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find where the user
buffer by looking for the original irp->MdlAddress address, was but had no
luck finding it.

Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl
to another driver so that it can fill the corresponding output buffer?

If possible, please specify how to do it, including whether or not I need to
call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@msn.com
To unsubscribe send a blank email to xxxxx@listsosr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Use IoAllocateIrp instead and fill the IRP as you want.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: S. Drasnin
To: Windows System Software Devs Interest List
Sent: Wednesday, June 22, 2005 6:54 AM
Subject: Re: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

hi

Thanks for the response. I was using windbg to examine the IRP structure when I got to the IRP_MJ_INTERNAL_DEVICE_CONTROL handler in driver #2.

By the way, I came up with a work around since it appears that an internal device I/O control call (IoBuildDeviceIoControlRequest with IRP_MJ_INTERNAL_DEVICE_CONTROL) messes with the input and output buffer pointers passed to it - it tries to fix up the address (I would guess) and maybe you’re not supposed to pass a mdl pointer.

The work-around I did was to pass the Mdl pointer inside the input buffer (so that the OS wouldn’t mess with it) rather than passing it directly as the output buffer pointer. (Note that I did call MmGetSystemAddressForMdlSafe in driver #1 before calling IoBuildDeviceIoControlRequest.) Now I’m able to write data to that buffer and it gets returned OK to driver #1 and finally back to the application that did the original ReadFile() call. Before it crashed all the time for a particular test case of mine.

If you happen to know what the OS does to the input and output pointers you pass via a internal device I/O control call for the different types of accesses (METHOD_NEITHER, METHOD_BUFFERED, etc.) and any restrictions (such as not passing MDL pointers). I would love to know, though since I couldn’t find any meaty documentation on it.

thanks
sharon

----- Original Message -----
From: Jonathan Morrison [Microsoft]
Newsgroups: ntdev
To: Windows System Software Devs Interest List
Sent: Tuesday, June 21, 2005 12:14 PM
Subject: Re:[ntdev] How do you pass a Mdl pointer to another driver via IoBuildDeviceIoControlRequest?

Can you define " … by looking for the original irp->MdlAddress address,
was but had no luck finding it."? How are you passing/inspecting the IRP?

–
Jonathan Morrison
“S. Drasnin” wrote in message news:xxxxx@ntdev…
hi

I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the
user buffer is being described by a MDL (irp->MdlAddress) that is passed to
my driver’s IRP_MJ_READ handler.

In order to fill the Read File buffer with USB data, this usb driver (driver
#1) passes the irp->MdlAddress to another driver (driver #2) via a via an
internal device I/o control (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling
IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the
“OutputBuffer” parameter.

I defined the IoControl for this call as METHOD_NEITHER:
CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER,
FILE_ANY_ACCESS)

In driver #2, in my InternalIoCtrl handler, I tried to find where the user
buffer by looking for the original irp->MdlAddress address, was but had no
luck finding it.

Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl
to another driver so that it can fill the corresponding output buffer?

If possible, please specify how to do it, including whether or not I need to
call MmGetSystemAddressForMdlSafe, etc.

thanks
Sharon

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@msn.com
To unsubscribe send a blank email to xxxxx@listsosr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Thank Mickal.

I have found the reason. I use
status = IoGetDeviceObjectPointer(&name, FILE_READ_DATA,
&FileObject, &DeviceObject);
to get the device object. When I add
ObDereferenceObejct(FileObject);
to my program below IO control completed code, it seems to work. I can
access the virtual drive by type drive letter in explorer.

But it cause anthor problem, when I send anthor IO control to my
driver, I got a BSOD ( FAT_FILE_SYSTEM(23) ),
ExceptionAddress: (nt!IoIsOperationSynchronous+0x0000000a).

I am a newbie for Device Driver Development. So I am very confuse with
this probelm now. The UM DeviceIoControl can work well, but the KM
DeviceIoControl will cause the BSOD. why ?

thanks for all reply.

-L

On 6/22/05, Maxim S. Shatskih wrote:
> Use IoAllocateIrp instead and fill the IRP as you want.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: S. Drasnin
> To: Windows System Software Devs Interest List
> Sent: Wednesday, June 22, 2005 6:54 AM
> Subject: Re: Re:[ntdev] How do you pass a Mdl pointer to another driver via
> IoBuildDeviceIoControlRequest?
>
>
> hi
>
> Thanks for the response. I was using windbg to examine the IRP structure
> when I got to the IRP_MJ_INTERNAL_DEVICE_CONTROL handler in driver #2.
>
> By the way, I came up with a work around since it appears that an internal
> device I/O control call (IoBuildDeviceIoControlRequest with
> IRP_MJ_INTERNAL_DEVICE_CONTROL) messes with the input and output buffer
> pointers passed to it - it tries to fix up the address (I would guess) and
> maybe you’re not supposed to pass a mdl pointer.
>
> The work-around I did was to pass the Mdl pointer inside the input buffer
> (so that the OS wouldn’t mess with it) rather than passing it directly as
> the output buffer pointer. (Note that I did call
> MmGetSystemAddressForMdlSafe in driver #1 before calling
> IoBuildDeviceIoControlRequest.) Now I’m able to write data to that buffer
> and it gets returned OK to driver #1 and finally back to the application
> that did the original ReadFile() call. Before it crashed all the time for a
> particular test case of mine.
>
> If you happen to know what the OS does to the input and output pointers you
> pass via a internal device I/O control call for the different types of
> accesses (METHOD_NEITHER, METHOD_BUFFERED, etc.) and any restrictions (such
> as not passing MDL pointers). I would love to know, though since I couldn’t
> find any meaty documentation on it.
>
> thanks
> sharon
>
> ----- Original Message -----
> From: Jonathan Morrison [Microsoft]
> Newsgroups: ntdev
> To: Windows System Software Devs Interest List
> Sent: Tuesday, June 21, 2005 12:14 PM
> Subject: Re:[ntdev] How do you pass a Mdl pointer to another driver via
> IoBuildDeviceIoControlRequest?
>
> Can you define " … by looking for the original irp->MdlAddress address,
> was but had no luck finding it."? How are you passing/inspecting the IRP?
>
> –
> Jonathan Morrison
> “S. Drasnin” wrote in message news:xxxxx@ntdev…
> hi
>
> I have a USB driver that sets DO_DIRECT_IO. As a result, for ReadFile, the
> user buffer is being described by a MDL (irp->MdlAddress) that is passed to
> my driver’s IRP_MJ_READ handler.
>
>
> In order to fill the Read File buffer with USB data, this usb driver (driver
> #1) passes the irp->MdlAddress to another driver (driver #2) via a via an
> internal device I/o control
> (IRP_MJ_INTERNAL_DEVICE_CONTROL): by calling
> IoBuildDeviceIoControlRequest and passing irp->MdlAddress as the
> “OutputBuffer” parameter.
>
> I defined the IoControl for this call as METHOD_NEITHER:
> CTL_CODE(FILE_DEVICE_UNKNOWN, IOCTL_BASE+4, METHOD_NEITHER,
> FILE_ANY_ACCESS)
>
> In driver #2, in my InternalIoCtrl handler, I tried to find where the user
> buffer by looking for the original irp->MdlAddress address, was but had no
> luck finding it.
>
> Can somebody tell me if it possible to do what I’m trying to do: pass a pMdl
> to another driver so that it can fill the corresponding output buffer?
>
> If possible, please specify how to do it, including whether or not I need to
> call MmGetSystemAddressForMdlSafe, etc.
>
> thanks
> Sharon
>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@msn.com
> To unsubscribe send a blank email to xxxxx@listsosr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com