Rolling an IRP vs. makin Zw calls

NTFSD
1

Hello everyone,

Since i was learning (basically reading the NTInsier article) how to build our own IRP and send it down the stack, i had a question.

One thing that i know about sending IRP rather than making Zw calls is that they remove the recursion problem of entering from the top of the stack.

Are there any more benefits of using the IRP method over Zw calls?

Thank you.
Tushar.

2

> Are there any more benefits of using the IRP method over Zw calls?

ZwXxx are < APC_LEVEL, and, your own IRPs allocated with IoAllocateIrp will
possibly (depends on IRP_MJ code) work on APC_LEVEL

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Thank you Maxim for your reply.

If i understand correctly, Zw calls cannot be made at APC_LEVEL because in case of Zw calls the second phase of I/O completion requires a special kernel mode APC to be queued, which is disabled at APC_LEVEL. However, this is not required while rolling an IRP.

Another question that i have is based on your reply : “your own IRPs allocated with IoAllocateIrp will
possibly (depends on IRP_MJ code) work on APC_LEVEL”

Why will it POSSIBLY work?

Thank you.
Tushar.

4

> Another question that i have is based on your reply : "your own IRPs
allocated

with IoAllocateIrp will
possibly (depends on IRP_MJ code) work on APC_LEVEL"

Why will it POSSIBLY work?

Look at the documentation, maybe not all FSDs support all IRP_MJ on APC_LEVEL.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com