Hi,
I am developing a virtual scsi miniport. Where i need to send an IOCTL to my
miniport from a workitem with an SRB to be marked complete. For this I plan
to create an SRB with its databuffer pointer pointing to my old SRB which is
to be completed. Then I create an IRP with this new SRB. And send it to my
miniport dev obj.
The code below is sending a char buffer instead of SRB for testing purpose:
#define SCSIOP_COMPLETE_SRB 0xFE
NTSTATUS SendSRBCompletionIRP(IN PWORKITEM_FOR_DEFERRED_IO
WorkItemToBeCompleted)
{
PSCSI_REQUEST_BLOCK FakeSrb = NULL;
PIRP pIrp = NULL;
PIO_STACK_LOCATION pIoStackLocation = NULL;
PKEVENT Event = NULL;
IO_STATUS_BLOCK IoStatus = {};
NTSTATUS ntStatus = NULL;
char * Buffer = NULL;
FakeSrb = (PSCSI_REQUEST_BLOCK)ExAllocatePoolWithTag(NonPagedPool,
sizeof(SCSI_REQUEST_BLOCK), ‘brsF’);
if(!FakeSrb)
{
NBDDbgPrint(“SendSRBCompletionIRP:: Error Allocating the Fake SRB!”);
NBDASSERT(0);
return STATUS_MEMORY_NOT_ALLOCATED;
}
Event = (PKEVENT) ExAllocatePoolWithTag(NonPagedPool,
sizeof(KEVENT), ‘tnve’);
if(!Event)
{
NBDDbgPrint(“SendSRBCompletionIRP:: Error Allocating Event Memory!”);
NBDASSERT(0);
ExFreePoolWithTag(FakeSrb, ‘brsF’);
return STATUS_MEMORY_NOT_ALLOCATED;
}
Buffer = (char *)ExAllocatePoolWithTag(NonPagedPool,
sizeof(“Charan”+1), ‘ffub’);
if(!Buffer)
{
NBDDbgPrint(“SendSRBCompletionIRP:: Buffer Allocation Failed!”);
NBDASSERT(0);
ExFreePoolWithTag(Event, ‘tnve’);
ExFreePoolWithTag(FakeSrb, ‘brsF’);
return STATUS_MEMORY_NOT_ALLOCATED;
}
RtlCopyBytes((PVOID)Buffer, (PVOID)“Charan\0”, 7);
// SCSI address of the other virtual target used for completion
// or real target that pScsiRequestBlock was initiated to.
// Depends of the flags we’ll set in SRB.
FakeSrb->PathId = WorkItemToBeCompleted->srb->PathId;
FakeSrb->TargetId = WorkItemToBeCompleted->srb->TargetId;
FakeSrb->Lun = WorkItemToBeCompleted->srb->Lun;
FakeSrb->DataBuffer = (PVOID) WorkItemToBeCompleted->srb;
// other SRB fields set here
FakeSrb->Length = SCSI_REQUEST_BLOCK_SIZE;
FakeSrb->QueueAction = WorkItemToBeCompleted->srb->QueueAction;
FakeSrb->SrbFlags = WorkItemToBeCompleted->srb->SrbFlags |
SRB_FLAGS_BYPASS_FROZEN_QUEUE;
CDB &cdb = *(CDB *)FakeSrb->Cdb;
cdb.CDB10.OperationCode = SCSIOP_COMPLETE_SRB;
pIrp = IoBuildDeviceIoControlRequest(IOCTL_SCSI_MINIPORT,
WorkItemToBeCompleted->DeviceExtension->pMiniportDevObj,
FakeSrb,
sizeof(SCSI_REQUEST_BLOCK),
NULL, 0, FALSE,
Event,
&IoStatus);
if(!pIrp)
{
NBDDbgPrint(“SendSRBCompletionIRP:: Error Allocating IRP!”);
NBDASSERT(0);
ExFreePoolWithTag(Buffer, ‘ffub’);
ExFreePoolWithTag(Event, ‘tnve’);
ExFreePoolWithTag(FakeSrb, ‘brsF’);
return STATUS_MEMORY_NOT_ALLOCATED;
}
pIoStackLocation = IoGetNextIrpStackLocation( pIrp );
pIoStackLocation->Parameters.Scsi.Srb = FakeSrb;
pIoStackLocation->MajorFunction = IRP_MJ_SCSI;
KeClearEvent(Event);
ntStatus = IoCallDriver(WorkItemToBeCompleted->DeviceExtension->pMiniportDevObj,
pIrp);
if(STATUS_PENDING == (ntStatus))
KeWaitForSingleObject(Event, Executive, KernelMode, TRUE, NULL);
if(NT_SUCCESS(ntStatus))
ntStatus = IoStatus.Status;
ExFreePoolWithTag(Buffer, ‘ffub’);
ExFreePoolWithTag(Event, ‘tnve’);
ExFreePoolWithTag(FakeSrb, ‘brsF’);
return ntStatus;
}
But the problem here is that IoCallDriver returns *STATUS_REVISION_MISMATCH
(0xC0000059)*.
The StartIO code is as follows:
{
if(Srb->Function == SRB_FUNCTION_EXECUTE_SCSI)
StartCDB(DeviceExtension, Srb);
else if(Srb->Function == SRB_FUNCTION_IO_CONTROL)
{
NBDDbgPrint(“HwScsiStartIo: Miniport IOCtl received:
Databuffer is :: %s\n”, “%s”, Srb->DataBuffer);
ScsiPortNotification(RequestComplete, DeviceExtension, Srb);
}
else
CompleteSRB(DeviceExtension, Srb, (UCHAR)SRB_STATUS_BAD_FUNCTION);
}
Also in StartCDB Function I handle the Operation code
SCSIOP_COMPLETE_SRBas follows:
case SCSIOP_COMPLETE_SRB:
{
NBDDbgPrint(“SCSIOP_COMPLETE_SRB: Miniport IOCtl
received: Databuffer is :: %s\n”, “%s”, Srb->DataBuffer);
DbgBreakPoint();
break;
}
But none of the messages is printed and i get *STATUS_REVISION_MISMATCH* in
IoCallDriver.
Can you please help me find solution to this problem or tell me where am I
going wrong in above code?
Thanks and Regards,
Charansing D Deore
Sr. Software Developer,
CalSoft Pvt Ltd.
Baner Road, Pune-411045
Office: +91 20 40792900 Ext: 3055
Cell: +91 9850960550
