Re: CSQ and IoMarkIrpPending by Mark
Mark
Mon Feb 06 21:18:35 CST 2006
On Mon, 6 Feb 2006 21:51:56 -0500, "Skywing"
<skywing_NO_SPAM_@valhallalegends.com> wrote:
>I'm curious too, so I did a bit of looking around.
>
>A bit of disassembly shows that IoCsqInsertIrp does in fact do this. It was
>easy to determine this through the use of WinDbg in LKD mode against an x64
>Win2003SP1 machine, and dumpbin /disasm csq.lib with _NT_SYMBOL_PATH set
>appropriately.
>
>I am of the opinion that this is a documentation omission and that csq was
>always supposed to do IoMarkIrpPending(Irp).
>
Nice work.
I'd still not rely on this behavior until it gets documented.
>From the 3790.1830 DDK for the x64 csq.lib:
>
>WdmlibIoCsqInsertIrp:
> 0000000000000000: 45 33 C9 xor r9d,r9d
> 0000000000000003: E9 00 00 00 00 jmp WdmlibIoCsqInsertIrpEx
>
>; .
>; .
>; .
>
>WdmlibIoCsqInsertIrpEx:
> 0000000000000000: 48 83 EC 38 sub rsp,38h
> 0000000000000004: 48 89 5C 24 40 mov qword ptr [rsp+40h],rbx
> 0000000000000009: 48 89 6C 24 48 mov qword ptr [rsp+48h],rbp
> 000000000000000E: 48 89 74 24 50 mov qword ptr [rsp+50h],rsi
> 0000000000000013: 48 89 7C 24 58 mov qword ptr [rsp+58h],rdi
> 0000000000000018: 33 ED xor ebp,ebp
> 000000000000001A: 4D 85 C0 test r8,r8
> 000000000000001D: 4C 89 64 24 30 mov qword ptr [rsp+30h],r12
> 0000000000000022: 49 8B F0 mov rsi,r8
> 0000000000000025: 48 8B D9 mov rbx,rcx
> 0000000000000028: 4D 8B E1 mov r12,r9
> 000000000000002B: 48 8B FA mov rdi,rdx ; rdi = Irp
>
>; .
>; .
>; .
>
> 00000000000000A9: 48 8B 87 B8 00 00 mov rax,qword ptr [rdi+0B8h]
>; Irp+0xb8 == Irp->Tail.Overlay.CurrentStackLocation (x64)
> 00
> 00000000000000B0: 80 48 03 01 or byte ptr [rax+3],1 ;
>IO_STACK_LOCATION+3 == Control, 0x1 == SL_PENDING_RETURNED (x64)
>
>;
>; And this is what IoMarkIrpPending() corresponds to in ntddk.h
>;
>; #define IoMarkIrpPending( Irp ) ( \
>; IoGetCurrentIrpStackLocation( (Irp) )->Control |= SL_PENDING_RETURNED )
>;
>;
>; And here is IoGetCurrentIrpStackLocation()
>;
>; #define IoGetCurrentIrpStackLocation( Irp ) (
>(Irp)->Tail.Overlay.CurrentStackLocation )
>;
>
>; The prototype for IoCsqInsertIrpEx is as follows:
>
>; NTSTATUS
>; IoCsqInsertIrpEx(
>; IN PIO_CSQ Csq, // rcx
>; IN PIRP Irp, // rdx
>; IN PIO_CSQ_IRP_CONTEXT Context, // r8
>; IN PVOID InsertContext // r9
>; );
>
>
>
>
>"Gerald S." <anonymous@discussions.microsoft.com> wrote in message
>news:e1%23jc14KGHA.964@tk2msftngp13.phx.gbl...
>> Thanks for the reply, however, I'd like to know the exact answer - whether
>> the cancel sample contains a horrific bug or IoCsqInsertIrp calls
>> IoMarkIrpPending? In other words, should I rush to update my old drivers
>> or this can wait?
>>
>> --
>>
>> "Mark Roddy" <markr@hollistech.com> wrote in message
>> news:3nufu1962s13pe0rdnmgmr13dcf7tipqut@4ax.com...
>>> On Tue, 7 Feb 2006 12:30:48 +1300, "Gerald S."
>>> <anonymous@discussions.microsoft.com> wrote:
>>>
>>>>Hi, I had an impression that I don't need to call IoMarkIrpPending before
>>>>IoCsqInsertIrp, as the latter internally marks the inserted IRP pending
>>>>anyway. Is this correct?
>>>>
>>>>Thanks
>>>
>>> That is actually an excellent question. The documentation doesn't say
>>> anything. The cancel sample implies that the IRP is marked pending by
>>> a call to IoCsqInsertIrp. So we have undocumented behavior with a
>>> sample as the only guide. As far as I know IoMarkIrpPending can be
>>> called repeatedly and do no harm. I would not rely on undocumented
>>> behavior and just mark the IRP pending.
>>>
>>>
>>> =====================
>>> Mark Roddy DDK MVP
>>> Windows Vista/2003/XP/2000 Consulting
>>> Device and Filesystem Drivers
>>> Hollis Technology Solutions 603-321-1032
>>> www.hollistech.com
>>
>>
>
=====================
Mark Roddy DDK MVP
Windows Vista/2003/XP/2000 Consulting
Device and Filesystem Drivers
Hollis Technology Solutions 603-321-1032
www.hollistech.com