The event objects are created in the user program and made accessible via
RtlInitUnicodeString and IoCreateNotificationEvent when my device
interface is opened. The acess to the event/handles is successful.
Leaving out some of the other details, my kernel code that does the
signalling and waiting looks like the following. It is done within a
function called from the IRP_MJ_CREATE handler.
//snip
DbgPrint( “SIGNALLING USER\n” );
if (UpwardEvent != NULL) {
DbgPrint( “SIGNALLED USER\n” );
KePulseEvent( UpwardEvent, 0, TRUE);
}
DbgPrint( “WAITING FOR USER\n” );
KeWaitForSingleObject
(
DownwardEvent,
UserRequest,
KernelMode,
TRUE,
NULL
);
DbgPrint( “WOKE UP FROM USER EVENT\n” );
KeClearEvent( DownwardEvent );
return;
Leaving out some of the other details, the user mode code that does the
signalling and responding looks like this…
do {
waitResult = WaitForSingleObject( UpwardEvent, 10000 );
switch (waitResult) {
case WAIT_ABANDONED:
printf( “Sorry, wait has been abandoned\n” );
break;
case WAIT_OBJECT_0:
printf( “Yippee! A signal from below, send it back.\n” );
PulseEvent( DownwardEvent );
break;
case WAIT_TIMEOUT:
printf( “A timeout has occurred in test.exe\n” );
break;
default:
printf( “Shouldn’t get here!\n” );
break;
}
} while (1);
The end result of this *should be* that my filter, which otherwise is
operating as expected, should be seeing a slight delay in processing the
CREATE calls due to the extra communication with Ring 3. Once the
signalling is working, I can add the code that is the *real* reason for
the communications oin the first place.
Again, this works the first time, but I never get called at my
IRP_MJ_CREATE entry point again (should see three such calls for the file
action I’m doing).
If I remove the signalling component from the filter driver, everything is
copacetic.
Any help or pointers/samples would be appreciated. I’m sure this is
something dumb…