Re: sequence of dispatch routines by Mark
Mark
Sat Sep 06 15:43:09 CDT 2003
On 6 Sep 2003 08:46:27 -0700, svyatoslav_@hotmail.com (Svyatoslav)
wrote:
>Hi,
>
>I looked at the SniffUSB (usbsnoop(y)) project and I can't figure out
>why the dispatchroutines of the filter driver are carried out before
>the dispatch routines of the function driver.
>It is a lower level filter driver, so I would expect that an IRP will
>be completed by a functiondriver routine before the filter driver can
>dispatch the given IRP.
>
>Could some-one give me a clue on this, I would really appreciate it.
>
Either we have a terminology problem or a serious confusion about how
IO Requests are processed in NT. IRPs are processed in dispatch
routines in several ways, one of which is to simply pass the IRP down
to the next driver in the stack without any processing. Another is to
queue the IRP for later processing without passing it down the stack.
A driver can also send the IRP down the device stack and process the
IRP after it is processed by the lower drivers. Finally, the IRP can
be completely processed in the Dispatch routine and completed by the
dispatch routine without ever being sent to the lower drivers.
In the general case a single IRP is completed once, and only once, by
one of the device drivers in the device stack. (I am going to ignore
the case where an IRP is recycled in a completion handler, as it just
increases the complexity of the model without adding much to this
discussion. I am also ignoring completion handling for the same
reason.)
So your statement "I would expect an IRP will be completed by a
function driver routine before the (lower) filter driver can dispatch
the given IRP" does not fit with the NT terminology and/or IO
processing model. In the general case an IRP can only be 'completed'
once. As I mentioned, the IO model is much more complex than your
expectations as well.
Some IRP requests (specifically some PnP IRPs,) are required to be
sent to the lower driver first before they are processed by the upper
drivers in a device stack. I suspect that it is this sort of request
that is causing your confusion.
=====================
Mark Roddy
Windows XP/2000/NT Consulting, Microsoft DDK MVP
Hollis Technology Solutions 603-321-1032
www.hollistech.com
markr@hollistech.com
For Windows Device Driver Training: see www.azius.com