User mode to Kernel mode

Can a handle to an event created using CreateEvent() in user mode be passed
to Kernel mode and if so, is there anything special that we need to do
anything driver to use that handle in kernel mode?

Thank you for your reply.

"novice" <> wrote...
> Can a handle to an event created using CreateEvent() in user mode be
> passed
> to Kernel mode and if so, is there anything special that we need to do
> anything driver to use that handle in kernel mode?

You'll get better results asking in a group like
"microsoft.public.development.device.drivers". This group
"microsoft.public.windows.vista.general" is oriented towards end-users.

You can pass a user-mode handle to kernel mode, by using an IOCTL. But, a
handle is a pointer into a handle table, which is per-process. So you need
to make sure that the context in which the handle is referenced is always
consistent. If your driver is in the middle of a stack of other drivers
(such as a filter driver; or any non-monolithic driver, really), you can't
really be sure of the context in which it will be running. Also if you call
IoRegisterDeviceInterface() (which you should) then IRPs will go on top of
the stack holding your device object, not direct to your driver. So, by the
time the IOCTL arrives, you might be in any arbitrary context. Basically,
using Event handles is possible; but it is a very fragile and easily broken
mechanism.

A much more robust mechanism will be to create a named event in user mode;
and then share the *name* of the event, rather than the handle. In your user
mode process, just call CreateEvent(NULL, TRUE, FALSE, "MyEvent"). Your
driver can then reference the event by name, by passing the event name
"MyEvent" as a parameter to KeSetEvent(). This will avoid the many possible
pitfalls (and blue-screens) of trying to use a user-mode handle in kernel
mode.

Hope it helps,
--
Andrew McLaren
amclar (at) optusnet dot com dot au