Sharing the event handle from app to driver , notification of interrupt

NTFSD
1

Hi all,

I have created the event from application to driver.

In one IOCTL where im calling the WaitForSingleObject with NULL and calling infinetley the KewaitforSingleObect with NULL and wait for ISR then ioctyl will be completed from driver to application.

Its any way to how to overcome the KewaitforSingleObect with NULL to be set to KesetEvent through Ioctl.

Rather than using inverted call method

2

if i use KewaitforSingleObect with NULL means its a block method.

It wont allow any IOCTL request to be send from app to driver ?

Pls share your idea.

On Mon, Dec 26, 2016 at 12:19 PM, wrote:

> Hi all,
>
> I have created the event from application to driver.
>
> In one IOCTL where im calling the WaitForSingleObject with NULL and
> calling infinetley the KewaitforSingleObect with NULL and wait for ISR then
> ioctyl will be completed from driver to application.
>
> Its any way to how to overcome the KewaitforSingleObect with NULL to be
> set to KesetEvent through Ioctl.
>
> Rather than using inverted call method
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

3

The question is not quite clear. I am not able to understand who is waiting
indefinitely. Is it the driver or the user mode app?

On Mon, Dec 26, 2016 at 1:18 PM, Prabhakar V wrote:

> if i use KewaitforSingleObect with NULL means its a block method.
>
> It wont allow any IOCTL request to be send from app to driver ?
>
> Pls share your idea.
>
> On Mon, Dec 26, 2016 at 12:19 PM, wrote:
>
>> Hi all,
>>
>> I have created the event from application to driver.
>>
>> In one IOCTL where im calling the WaitForSingleObject with NULL and
>> calling infinetley the KewaitforSingleObect with NULL and wait for ISR then
>> ioctyl will be completed from driver to application.
>>
>> Its any way to how to overcome the KewaitforSingleObect with NULL to be
>> set to KesetEvent through Ioctl.
>>
>> Rather than using inverted call method
>>
>> —
>> NTFSD is sponsored by OSR
>>
>>
>> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>> software drivers!
>> Details at http:
>>
>> To unsubscribe, visit the List Server section of OSR Online at <
>> http://www.osronline.com/page.cfm?name=ListServer&gt;
>>
>
> — NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis,
> WDF, Windows internals and software drivers! Details at To unsubscribe,
> visit the List Server section of OSR Online at</http:>

4

Yes, in case of a handle( i.e. file object) opened for synchronous access. If a handle is opened for asynchronous access( FILE_FLAG_OVERLAPPED ) it can be used to issue multiple concurrent requests. OR just open a pool of handles for synchronous access.

5

App will continuously send the iotl to driver where in evtiotrol calling
the kewaitforsingleobject with null which is wait for interrupt in isr n
queue to dpc where I’m setting the events.

How I can send one ioctl which is waiting in driver infinitely and set the
events.

On 26-Dec-2016 9:18 PM, wrote:

>


>
> Yes, in case of a handle( i.e. file object) opened for synchronous access.
> If a handle is opened for asynchronous access( FILE_FLAG_OVERLAPPED ) it
> can be used to issue multiple concurrent requests. OR just open a pool of
> handles for synchronous access.
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>

6

I don’t see any problem here. A user application waits on an event in kernel mode and a DPC routine signals this event. There is no deadlock in that scenario.

7

but my application where not exit because it continoulsy send the ioctl to driver where we are calling the KewaitforSingleObect with NULL means its a block method.

How i can exit the user application.

8

Two methods

  1. KeWaitForMultipleObjects with a second event to signal termination.

  2. KeWaitForSingleObject with UserMode wait mode or/and Alertable state set to TRUE. This allows to interrupt waiting or kill the application. More on this here https://msdn.microsoft.com/en-us/library/windows/hardware/ff565592(v=vs.85).aspx

KeWaitForSingleObject( Event, Executive, UserMode, TRUE, NULL);

The event should not be allocated on a stack as UserMode wait mode allows a kernel thread stack to be swapped out.