I'm currently implementing a packet capturing intermediate driver. One
of the IOCTL I have set up is a request to capture a packet of a
certain type. In my case, IOCTL_CAPTURE_PACKET is METHOD_BUFFERED, not
overlapped and contains UINT of EthernetType to capture. This IRP is
pended until a packet meeting the requirements is seen at which point
the IM driver copies the packet content into the SystemBuffer of the
IRP and completes the IRP.

I also have IOCTL_CANCEL_ALL_PENDING_IRP and IOCTL_SEND_PACKET which
cancels all current pending IRP's and sends a packet out respectively.

In my initial tests my application side program was a series of cmdline
executable that simply called DeviceIoControl() with the correct IOCTL
code. Later I moved it to a Win32 Application with threads. This is
where my problem began. A single pending IRP blocks the entire
application form making further IRP requests.

My question is this:- do I need to use Overlapped? Can I open multiple
handles to the adapter instead (I am about to try this, fairly sure it
will work but not sure if that's the best solution)

Any help, is always appreciated!

Thank you!

if all of your threads are sending I/O to the same thread handle, then
either each thread needs its own handle or you need to do overlapped I/O.
i/o sent on a non overlapped handle is synchronous for all i/o sent to the
handle, not just the thread which is sending the i/o.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Tierrie" <tierrie@gmail.com> wrote in message
news:1135881661.237126.18980@f14g2000cwb.googlegro ups.com...

If a handle is opened without FILE_FLAG_OVERLAPPED, all I/O requests are
serialized. Only one request will be in progress at any time.

"Tierrie" <tierrie@gmail.com> wrote in message
news:1135881661.237126.18980@f14g2000cwb.googlegro ups.com...

Thanks to both Doron and Alexander for confirming this.

Is there a "best practice" solution to this? Am I strongly discouraged
from opening multiple file handles if it is low volume?

I suspect that if I am handling many many captures (say TCP) then I'd
need OVERLAPPED but if I am capturing some low volume packets then a
new handle would be easier to implement and maintain.

if there is a shared state between the multiple requests which are pending ,
i would think one handle with overlapped i/o would be best b/c then all i/o
share the same PFILE_OBJECT and you can save the shared state in a context
in the file object. a few handles will do no harm otherwise, it is when you
get into the 1000s or more that it becomes a design issue really.

d

--
Please do not send e-mail directly to this alias. this alias is for
newsgroup purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.


"Tierrie" <tierrie@gmail.com> wrote in message
news:1135886145.812940.90530@g49g2000cwa.googlegro ups.com...

Yes, or open several file handles. Without FILE_FLAG_OVERLAPPED, the file
handle is serialized - all other threads are stopped on some mutex inside the
FILE_OBJECT till the current IO operation of the file will complete.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com