Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Communication between kernel-mode and user-mode application

I have built a WFP callout driver which runs in kernel mode. Now, I'm trying to figure out how to communicate between this driver and my GUI application which runs in user-mode. Any ideas?

Exactly what I want is something like this:

  1. The callout driver detects an incomming connection on port 4444 (This is not part of my question)
  2. The drivers send a message to the user-mode app.
  3. The app shows a notification to the user and asks it if we should accept/block the connection.
  4. The user-mode app sends back the user's response to the callout driver.

Thanks!

like image 673
henrikpersson Avatar asked Feb 08 '11 22:02

henrikpersson


People also ask

How a user mode is transferred to kernel mode?

System Call Interfaces (SCI) are the only way to transit from User space to kernel space. Kernel space switching is achieved by Software Interrupt, which changes the processor mode and jump the CPU execution into interrupt handler, which executes corresponding System Call routine.

What is the difference between kernel and user mode?

The difference between User Mode and Kernel Mode is that user mode is the restricted mode in which the applications are running and kernel mode is the privileged mode which the computer enters when accessing hardware resources.

How user mode and kernel mode instructions are handled?

In kernel mode, the program has direct and unrestricted access to system resources. In user mode, the application program executes and starts. In user mode, a single process fails if an interrupt occurs. Kernel mode is also known as the master mode, privileged mode, or system mode.

Which are the three different ways the CPU can go from user mode to kernel mode?

There are three events at which the processor should switch to the kernel address space: (1) supervisor call (called a trap instruction on the PDP-11); (2) an interrupt; and (3) an illegal instruction.


1 Answers

I agree with LordDoskias. You need to create a device object and make it available to the Win32 realm. Then you can use CreateFile, ReadFile, WriteFile and the already mentioned DeviceIoControl to send requests.

In order to get notifications from the driver to the application, you can use the so-called inverted call model. You send down some IRPs (via one of the mentioned mechanisms) and do that in an asynchronous manner (or in separate threads). Then, the driver keeps them dangling until it has to notify the user mode component about something and then returns the completed IRP. Alternative methods are to set some event and have the UM request whatever the driver keeps in some kind of queue...

The gist is, there is no direct way that the driver can send some message to the user mode application.

like image 165
0xC0000022L Avatar answered Sep 18 '22 16:09

0xC0000022L