asynchronous I/O problem with KMDF



Hello to all,
I'm developing a device driver for a gaming usb scanner and, normally,
it works quite well (thanks
Eliyas Yakub). There is something that I can't understand with the
asynchronous i/o; the scanner may block several time due to its
internal workflow or due to known firmware bugs.
I've used this approach (can someone evaluate it?).
The device supports two kind of ioctl (no read nor write): requests
that do not require a firmware work (versioning and so on) and
requests that require firmware work.
The deviceadd callback creates the default queue as parallel and an
ausiliary queue as sequential. The sequential queue is used to manage
these request that need firmware work because that firmware can manage
only a command once.

WDF_IO_QUEUE_CONFIG_INIT_DEFAULT_QUEUE(&_def_queue_config,
WdfIoQueueDispatchParallel);
_def_queue_config.EvtIoDeviceControl = OnIoDeviceControl;
_status = WdfIoQueueCreate(_device, &_def_queue_config,
WDF_NO_OBJECT_ATTRIBUTES, &_def_queue);

WDF_IO_QUEUE_CONFIG_INIT(&_fwcmd_queue_config,
WdfIoQueueDispatchSequential);
_fwcmd_queue_config.EvtIoDeviceControl = OnFWCommandIoDeviceControl;
_status = WdfIoQueueCreate(_device, &_fwcmd_queue_config,
WDF_NO_OBJECT_ATTRIBUTES, &(_dev_context->FwCommandQueue));

When the framework deliver a new request to my default
EvtIoDeviceControl (OnIoDeviceControl on the snippet above), it is
immediately completed if it belongs to a ioctl that not requires
firmware; it is requeued to the sequential queue otherwise. In this
second case, my default EvtIoDeviceControl returns immediately after
an WdfRequestForwardToIoQueue.
At the beginning of my ausiliary EvtIoDeviceControl
(OnFWCommandIoDeviceControl on the snippet above) I use
WdfRequestMarkCancelable to be notified about request cancellation.
After, i have to write the firmware command using
WdfUsbTargetPipeWriteSynchronously, and receive the response by
WdfUsbTargetPipeReadSynchronously before complete the user ioctl
request.
When the firmware works, all this appear to work fine. One of the
known firmware bugs is that it miss the response in certain
circumstances. When this happen, WdfUsbTargetPipeReadSynchronously
block undefinitely (I known about timeout, but I prefer that is the
application to choose its timeout).
And, finally, there is the problem.
When I reproduce the situation due to the firmware blocks, my test
consolle application cannot use CancelIo beacuse it bloks into the
DeviceIoControl call (I've verified using same printf).
Application side I use this code:

HANDLE Hnd=CreateFile("\\\\.\\MyDevice", GENERIC_READ | GENERIC_WRITE,
0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL);

OVERLAPPED _overlapped;
BOOL _result=FALSE;
HANDLE _event;

memset(&_overlapped, 0, sizeof(OVERLAPPED));
_event = CreateEvent(NULL,TRUE,FALSE,NULL);
_overlapped.hEvent = _event;

_result=DeviceIoControl(Hnd, Code, InBuffer, InBufferSize, OutBuffer,
OutBufferSize, BytesReturned, &_overlapped);
if (!_result) {
if (GetLastError() == ERROR_IO_PENDING) {
switch (WaitForSingleObject(_event, 5000)){
....
....

The most strange (for me) thing is that if I open a new process of my
test application, it works as expected; DeviceIoControl fails and
WaitForSingleObject wait until the timeout expires.
But, why the first DeviceIoControl does not return? Using the debugger
I can see that the second request is delivered to my default
EvtIoDeviceControl; it is forwarded to the sequential queue and its
callback is NOT invocked (this is right). User mode DeviceIoControl
exit immediately. Why the first call blocks?

.



Relevant Pages

  • Re: DLINK 614+ - SOHO routers, system DOS
    ... the flaws reported to DLINK on May 24th and posted to bugtraq have ... Rev A's latest firmware available is still 2.30 and therefore IS ... | left in an unstable state immediately followed by a system reboot. ... | along with the request or if no ip address is available for dynamic ...
    (Bugtraq)
  • [NT] Atmel SNMP Non Public Community String DoS Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Atmel Firmware 1.3 ... If an SNMP read request is made with a community name different than ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • Re: XP USB driver stack/lost bytes on bulk transfer
    ... I think there is another bug in the scanner's firmware that causes it to ... > faster the usb device driver, the more bytes it must request each ...
    (microsoft.public.development.device.drivers)
  • Re: I/O operation has been aborted
    ... I'm currently running the latest firmware available in NA, ... korean instructions). ... aborted because of either a thread exit or an application request." ...
    (microsoft.public.windowsmedia.player)
  • Re: Okay, another question
    ... If you didn't it will only allow one request at a ... Windows 2k/XP/2k3 Filesystem and Driver Consulting ... > I've got IRP events working for the most part now, but am unable to use> them like I planned. ... > I have one thread running in the background, looping with> DeviceIoControl() to get the events. ...
    (microsoft.public.development.device.drivers)