Sharing Events with a User mode Application contd....(StreamClass)

NTDEV
1

I created an event in a user mode and sent it to a
streamclass kernel mode driver using set
property.(IKsproperty interface)

Then get a handle to it by calling
ObReferenceObjectByHandle(…)

When I set this event in kernel mode the user app
responds to it.But the problem is the driver is not
always able to dereference the handle as it doesnt
always get the SRB_CLOSE_instance.

Also a problem with this approach is that when
KeSetEvent is called it has to stay at passive level.
Otherwise I get a Bugcheck(Dispatch level).
Which means calling KelowerIrql??and that is something
risky…

Is there a safe and reliable way to share events in a
streamclass driver with user mode application ??

Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.
http://promotions.yahoo.com/new_mail

2

You should be able to set the event at dispatch, I have done exactly
this in the past (in another driver stack, not stream class). Are you
sure you have a valid PKEVENT pointer and there is still an outstanding
reference on it so it is still valid?

What exactly is the bugcheck code and parameters?

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Saurabh Tangri
Sent: Wednesday, January 05, 2005 2:46 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Sharing Events with a User mode Application
contd…(StreamClass)

I created an event in a user mode and sent it to a
streamclass kernel mode driver using set
property.(IKsproperty interface)

Then get a handle to it by calling
ObReferenceObjectByHandle(…)

When I set this event in kernel mode the user app
responds to it.But the problem is the driver is not
always able to dereference the handle as it doesnt
always get the SRB_CLOSE_instance.

Also a problem with this approach is that when
KeSetEvent is called it has to stay at passive level.
Otherwise I get a Bugcheck(Dispatch level).
Which means calling KelowerIrql??and that is something
risky…

Is there a safe and reliable way to share events in a
streamclass driver with user mode application ??

Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.
http://promotions.yahoo.com/new_mail

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

IRQL= getcurrentirql()

if (IRQL == PASSIVE_LEVEL)
{
KeSetEvent(UserEvent);
}
still bugchecks with
IRQL_NOT_LESS_OR_EQUAL (0xA)
IRQL = 02
That means KeSetEvent raised the IRQL to Dispatch.

if (IRQL == PASSIVE_LEVEL)
{
lowerirql(passivelevel)
KeSetEvent(UserEvent);
raiseirql(original)
}

works sending an event to the user app.

I checked in a kernel debugger and it is a valid
PKEVENT pointer.

— Doron Holan wrote:

> You should be able to set the event at dispatch, I
> have done exactly
> this in the past (in another driver stack, not
> stream class). Are you
> sure you have a valid PKEVENT pointer and there is
> still an outstanding
> reference on it so it is still valid?
>
> What exactly is the bugcheck code and parameters?
>
> d
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Saurabh Tangri
> Sent: Wednesday, January 05, 2005 2:46 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Sharing Events with a User mode
> Application
> contd…(StreamClass)
>
> I created an event in a user mode and sent it to a
> streamclass kernel mode driver using set
> property.(IKsproperty interface)
>
> Then get a handle to it by calling
> ObReferenceObjectByHandle(…)
>
> When I set this event in kernel mode the user app
> responds to it.But the problem is the driver is not
> always able to dereference the handle as it doesnt
> always get the SRB_CLOSE_instance.
>
> Also a problem with this approach is that when
> KeSetEvent is called it has to stay at passive
> level.
> Otherwise I get a Bugcheck(Dispatch level).
> Which means calling KelowerIrql??and that is
> something
> risky…
>
> Is there a safe and reliable way to share events in
> a
> streamclass driver with user mode application ??
>
>
>
>
>
>
> Do you Yahoo!?
> Yahoo! Mail - Helps protect you from nasty viruses.
> http://promotions.yahoo.com/new_mail
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>


Do you Yahoo!?
The all-new My Yahoo! - Get yours free!
http://my.yahoo.com

4

Just to reinforce, you should never lower to an irql that you didn’t
previously raise to. Ie, the code you have below is incorrect. How
about the results from !analyze and then additionally pointer value for
UserEvent

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Saurabh Tangri
Sent: Wednesday, January 05, 2005 3:17 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Sharing Events with a User mode Application
contd…(StreamClass)

IRQL= getcurrentirql()

if (IRQL == PASSIVE_LEVEL)
{
KeSetEvent(UserEvent);
}
still bugchecks with
IRQL_NOT_LESS_OR_EQUAL (0xA)
IRQL = 02
That means KeSetEvent raised the IRQL to Dispatch.

if (IRQL == PASSIVE_LEVEL)
{
lowerirql(passivelevel)
KeSetEvent(UserEvent);
raiseirql(original)
}

works sending an event to the user app.

I checked in a kernel debugger and it is a valid
PKEVENT pointer.

— Doron Holan wrote:

> You should be able to set the event at dispatch, I
> have done exactly
> this in the past (in another driver stack, not
> stream class). Are you
> sure you have a valid PKEVENT pointer and there is
> still an outstanding
> reference on it so it is still valid?
>
> What exactly is the bugcheck code and parameters?
>
> d
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Saurabh Tangri
> Sent: Wednesday, January 05, 2005 2:46 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Sharing Events with a User mode
> Application
> contd…(StreamClass)
>
> I created an event in a user mode and sent it to a
> streamclass kernel mode driver using set
> property.(IKsproperty interface)
>
> Then get a handle to it by calling
> ObReferenceObjectByHandle(…)
>
> When I set this event in kernel mode the user app
> responds to it.But the problem is the driver is not
> always able to dereference the handle as it doesnt
> always get the SRB_CLOSE_instance.
>
> Also a problem with this approach is that when
> KeSetEvent is called it has to stay at passive
> level.
> Otherwise I get a Bugcheck(Dispatch level).
> Which means calling KelowerIrql??and that is
> something
> risky…
>
> Is there a safe and reliable way to share events in
> a
> streamclass driver with user mode application ??
>
>
>
>
>
>
> Do you Yahoo!?
> Yahoo! Mail - Helps protect you from nasty viruses.
> http://promotions.yahoo.com/new_mail
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>


Do you Yahoo!?
The all-new My Yahoo! - Get yours free!
http://my.yahoo.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

How are you mapping userlevel even to the kernel?

Luck,


>From: “Doron Holan”
>Reply-To: “Windows System Software Devs Interest List”
>
>To: “Windows System Software Devs Interest List”
>Subject: RE: [ntdev] Sharing Events with a User mode Application
>contd…(StreamClass)
>Date: Wed, 5 Jan 2005 16:13:10 -0800
>
>Just to reinforce, you should never lower to an irql that you didn’t
>previously raise to. Ie, the code you have below is incorrect. How
>about the results from !analyze and then additionally pointer value for
>UserEvent
>
>d
>
>-----Original Message-----
>From: xxxxx@lists.osr.com
>[mailto:xxxxx@lists.osr.com] On Behalf Of Saurabh Tangri
>Sent: Wednesday, January 05, 2005 3:17 PM
>To: Windows System Software Devs Interest List
>Subject: RE: [ntdev] Sharing Events with a User mode Application
>contd…(StreamClass)
>
>IRQL= getcurrentirql()
>
>if (IRQL == PASSIVE_LEVEL)
>{
>KeSetEvent(UserEvent);
>}
>still bugchecks with
>IRQL_NOT_LESS_OR_EQUAL (0xA)
>IRQL = 02
>That means KeSetEvent raised the IRQL to Dispatch.
>============================
>if (IRQL == PASSIVE_LEVEL)
>{
>lowerirql(passivelevel)
>KeSetEvent(UserEvent);
>raiseirql(original)
>}
>
>works sending an event to the user app.
>
>
>I checked in a kernel debugger and it is a valid
>PKEVENT pointer.
>
>
>
>— Doron Holan wrote:
>
> > You should be able to set the event at dispatch, I
> > have done exactly
> > this in the past (in another driver stack, not
> > stream class). Are you
> > sure you have a valid PKEVENT pointer and there is
> > still an outstanding
> > reference on it so it is still valid?
> >
> > What exactly is the bugcheck code and parameters?
> >
> > d
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf
> > Of Saurabh Tangri
> > Sent: Wednesday, January 05, 2005 2:46 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] Sharing Events with a User mode
> > Application
> > contd…(StreamClass)
> >
> > I created an event in a user mode and sent it to a
> > streamclass kernel mode driver using set
> > property.(IKsproperty interface)
> >
> > Then get a handle to it by calling
> > ObReferenceObjectByHandle(…)
> >
> > When I set this event in kernel mode the user app
> > responds to it.But the problem is the driver is not
> > always able to dereference the handle as it doesnt
> > always get the SRB_CLOSE_instance.
> >
> > Also a problem with this approach is that when
> > KeSetEvent is called it has to stay at passive
> > level.
> > Otherwise I get a Bugcheck(Dispatch level).
> > Which means calling KelowerIrql??and that is
> > something
> > risky…
> >
> > Is there a safe and reliable way to share events in
> > a
> > streamclass driver with user mode application ??
> >
> >
> >
> >
> >
> >
> > Do you Yahoo!?
> > Yahoo! Mail - Helps protect you from nasty viruses.
> > http://promotions.yahoo.com/new_mail
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@windows.microsoft.com
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: unknown
> > lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
>
>
>
>
>Do you Yahoo!?
>The all-new My Yahoo! - Get yours free!
>http://my.yahoo.com
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>—
>Questions? First check the Kernel Driver FAQ at
>http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
>To unsubscribe send a blank email to xxxxx@lists.osr.com

_________________________________________________________________
Redefine team work. Discover your true potential.
http://www.microsoft.com/india/office/experience/ With the MS product suite.