Search Results

Search found 4 results on 1 pages for 'irp'.

Page 1/1 | 1 

• windows I/O manager - IRP's classification in read-like and write-like

  - by clyfe

  I am writing a windows filesystem minifilter driver that must fail IRP's in a preoperation callback. How can I find out from the callback parameters if the operation is read-like ( only reads data ) or it's write-like ( modifies data on the disk - write, delete etc ) ? I'm thinking on: Data->Iopb->TargetFileObject->ReadAccess Data->Iopb->TargetFileObject->WriteAccess But I'm not sure, I think thees are available only in postoperation callback. The documentation is really cumbersome. Code sample: FLT_PREOP_CALLBACK_STATUS Fail ( __inout PFLT_CALLBACK_DATA Data, __in PCFLT_RELATED_OBJECTS FltObjects, __deref_out_opt PVOID *CompletionContext ) { FLT_PREOP_CALLBACK_STATUS status = FLT_PREOP_SUCCESS_NO_CALLBACK; if ( IS WRITE_LIKE(Data, FltObjects) ) { // ??? HOW DO I FIND OUT???? if( FLT_IS_FASTIO_OPERATION(Data) ){ status = FLT_PREOP_DISALLOW_FASTIO; } else { status = FLT_PREOP_COMPLETE; } Data->IoStatus.Status = STATUS_ACCESS_DENIED; Data->IoStatus.Information = 0; return status; } return status; }

  Read the article

• Canceling a WSK I/O operation when driver is unloading

  - by eaducac

  I've been learning how to write drivers with the Windows DDK recently. After creating a few test drivers experimenting with system threads and synchronization, I decided to step it up a notch and write a driver that actually does something, albeit something useless. Currently, my driver connects to my other computer using Winsock Kernel and just loops and echoes back whatever I send to it until it gets the command "exit", which causes it to break out of the loop. In my loop, after I call WskReceive() to get some data from the other computer, I use KeWaitForMultipleObjects() to wait for either of two SynchronizationEvents. BlockEvent gets set by my IRP's CompletionRoutine() to let my thread know that it's received some data from the socket. EndEvent gets set by my DriverUnload() routine to tell the thread that it's being unloaded and it needs to terminate. When I send the "exit" command, the thread terminates with no problems, and I can safely unload the driver afterward. If I try to stop the driver while it's still waiting on data from the other computer, however, it blue screens with the error DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS. After I get the EndEvent but before I exit the loop, I've tried canceling the IRP with IoCancelIrp() and completing it with IoCompleteRequest(), but both of those give me DRIVER_IRQL_NOT_LESS_OR_EQUAL errors. I then tried calling WskDisconnect(), hoping that would cause the receive operation to complete, but that took me back to the CANCELLING_PENDING_OPERATIONS error. How do I cancel my pending I/O operation from my WSK socket at the IRQL I'm running at when the driver is unloaded?

  Read the article

• MACRO compilation PROBLEM

  - by wildfly

  i was given a primitive task to find out (and to put in cl) how many nums in an array are bigger than the following ones, (meaning if (arr[i] arr[i+1]) count++;) but i've problems as it has to be a macro. i am getting errors from TASM. can someone give me a pointer? SortA macro a, l LOCAL noes irp reg, <si,di,bx> push reg endm xor bx,bx xor si,si rept l-1 ;;also tried rept 3 : wont' compile mov bl,a[si] inc si cmp bl,arr[si] jb noes inc di noes: add di,0 endm mov cx,di irp reg2, <bx,di,si> pop reg2 endm endm dseg segment arr db 10,9,8,7 len = 4 dseg ends sseg segment stack dw 100 dup (?) sseg ends cseg segment assume ds:dseg, ss:sseg, cs:cseg start: mov ax, dseg mov ds,ax sortA arr,len cseg ends end start errors: Assembling file: sorta.asm **Error** sorta.asm(51) REPT(4) Expecting pointer type **Error** sorta.asm(51) REPT(6) Symbol already different kind: NOES **Error** sorta.asm(51) REPT(10) Expecting pointer type **Error** sorta.asm(51) REPT(12) Symbol already different kind: NOES **Error** sorta.asm(51) REPT(16) Expecting pointer type **Error** sorta.asm(51) REPT(18) Symbol already different kind: NOES Error messages: 6

  Read the article

• Windows 7 disk errors after a few hours of runtime

  - by GFK

  I'm having trouble understanding what is going on with my work PC. Whenever I boot it, it runs fine for a while, then starts to randomly show disk errors. The displayed error often contains the message "not enough storage is available to process this command", although depending on the application that fails it can be different. This has happened for weeks now and is getting worse. This is what troubles me: It never seems to impact critical parts of the system (no BSOD, no freeze). Only some applications seem impacted, refusing to function correctly after a while: Outlook 2010 cannot download RSS feeds anymore, Firefox 6 or IE9 cannot download anything bigger than 3MB without failing, Windows Update fails, all msi installers fail, Visual Studio 2010 starts failing in weird manners... It only happens after a while using it (typically 3 hours, but it seems that installing a program or compiling several times makes it shorter) Rebooting solves it (temporarily). The system: The OS is Windows 7 Pro Spanish SP1, 32 bits The system is an HP Compaq 6000 Pro with 4 GB memory (only 3.4GB usable since the system is 32bit), one 500GB hard drive. Installed applications include: Visual Studio 2010, SQL Server 2008 R2, VMWare Workstation 7, Microsoft Security Essentials, Office 2010. Shutting down all related services and processes doesn't seem to change anything. The diagnostics I've run so far: Hard drive : 465GB, 165GB free Process Explorer : physical and virtual memory seem ok (pagefile is 5.3GB, physical memory usage 70%, system commit 39%) Windows Memory diagnostic tool: OK CHKDSK returned: 488282111 KB total disk space. 281668248 KB in 265779 files. 150188 KB in 62949 indexes. 0 KB in bad sectors. 571755 KB in use by the system. The log file has occupied 65536 kilobytes. 205891920 KB available on disk. For non-spanish speakers, that means all ok. SMART diagnostic tools (DiskCheckup) report all values normal. temperatures are in the normal range (HWinfo). The event viewer doesn't seem to contain any significant message. ran CCleaner 3, without any noticeable effect. I was thinking about some file number limit (between Visual Studio projects and other applications, there are around 300.000 files on the hard drive), but I couldn't find any. It's possible there is something related with the use of the temporary folders (it's the only explanation I have for why applications fail but Windows doesn't), but I cannot confirm that. Only thing I cannot find out is if chkdsk reporting 65MB for the log is normal. It seems since Vista it always reports this. Any other cleaning/diagnostic tool you might know of? Edit: I ran several other tools since I first published the question: Seagate SeaTools (the HD manufacturer's analysis tool): complete test run OK. Intel Rapid 10.1 (the HD controller manufacturer's troubleshooting tool): the HD's ok. Microsoft Desktop Heap Monitor: Desktop Heap Information Monitor Tool (Version 8.1.2925.0) Copyright (c) Microsoft Corporation. All rights reserved. Session ID: 1 Total Desktop: ( 46464 KB - 11 desktops) WinStation\Desktop Heap Size(KB) Used Rate(%) WinSta0\Winlogon (s1) 128 3.6 WinSta0\Disconnect (s1) 64 3.8 WinSta0\Default (s1) 20480 3.0 msswindowstation\mssrestricteddesk (s0) 1024 0.2 __X78B95_89_IW__A8D9S1_42_ID (s0) 1024 0.2 Service-0x0-3e5$\Default (s0) 1024 0.6 Service-0x0-3e4$\Default (s0) 1024 0.3 Service-0x0-3e7$\Default (s0) 1024 2.1 WinSta0\Winlogon (s0) 128 1.9 WinSta0\Disconnect (s0) 64 3.8 WinSta0\Default (s0) 20480 0.0 All ok, desktop heap usage < 5% Edit 2: I tried totally resetting my account by creating a new one, logging under this new one and delete the first one (local rights and files), then logging back with this deleted account (it is a domain account). No luck. Also, I found out often the error is "not enough storage is available to process this command". Searching on the internet, I found an old troubleshooting tip (setting a registry key to raise the IRP stack limit, whatever it is) which did not change anything.

  Read the article

1