PIRP IoAllocateIrp(IN CCHAR  StackSize,IN BOOLEAN  ChargeQuota);

IRPtypedef struct _IRP
{..PMDL  MdlAddress;ULONG  Flags;union {struct _IRP  *MasterIrp;..PVOID  SystemBuffer;} AssociatedIrp;..IO_STATUS_BLOCK  IoStatus;KPROCESSOR_MODE  RequestorMode;BOOLEAN PendingReturned;..BOOLEAN  Cancel;KIRQL  CancelIrql;..PDRIVER_CANCEL  CancelRoutine;PVOID UserBuffer;union {struct {..union {KDEVICE_QUEUE_ENTRY DeviceQueueEntry;struct {PVOID  DriverContext[4];};};..PETHREAD  Thread;..LIST_ENTRY  ListEntry;..} Overlay;..} Tail;
} IRP, *PIRP;

PMDL  MdlAddress;
union {struct _IRP  *MasterIrp;..PVOID  SystemBuffer;} AssociatedIrp;
PVOID UserBuffer;

1) irp->AssociatedIrp.SystemBuffer
2) irp->MdlAddress
3) irp->UserBuffer    

//获得缓冲区
PUCHAR buf = NULL;
if(irp->MdlAddress != NULL)
{buffer = (PUCHAR)MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);
}
else
{buffer = (PUCHAR)irp->UserBuffer;
}
if(buffer = NULL)
{buffer = (PUCHAR)irp->AssociatedIrp.SystemBuffer;
}

DRIVER_ADD_DEVICE AddDevice;NTSTATUSAddDevice(__in struct _DRIVER_OBJECT  *DriverObject,__in struct _DEVICE_OBJECT  *PhysicalDeviceObject ){...}NTSTATUS IoCreateDevice(IN PDRIVER_OBJECT  DriverObject,IN ULONG  DeviceExtensionSize,IN PUNICODE_STRING  DeviceName  OPTIONAL,IN DEVICE_TYPE  DeviceType,IN ULONG  DeviceCharacteristics,IN BOOLEAN  Exclusive,OUT PDEVICE_OBJECT  *DeviceObject);typedef struct _DEVICE_OBJECT
{CSHORT  Type;USHORT  Size;LONG  ReferenceCount;PDRIVER_OBJECT  DriverObject;PDEVICE_OBJECT  NextDevice;PDEVICE_OBJECT  AttachedDevice;PIRP  CurrentIrp;PIO_TIMER  Timer;ULONG  Flags;//notice
  ULONG  Characteristics;__volatile PVPB  Vpb;PVOID  DeviceExtension;DEVICE_TYPE  DeviceType;CCHAR  StackSize;union {LIST_ENTRY  ListEntry;WAIT_CONTEXT_BLOCK  Wcb;} Queue;ULONG  AlignmentRequirement;KDEVICE_QUEUE  DeviceQueue;KDPC  Dpc;ULONG  ActiveThreadCount;PSECURITY_DESCRIPTOR  SecurityDescriptor;KEVENT  DeviceLock;USHORT  SectorSize;USHORT  Spare1;PDEVOBJ_EXTENSION  DeviceObjectExtension;PVOID  Reserved;
} DEVICE_OBJECT, *PDEVICE_OBJECT;NTSTATUS AddDevice(DriverObject, PhysicalDeviceObject)
{ PDEVICE_OBJECT fdo; IoCreateDevice(..., &fdo); fdo->Flags |= DO_BUFFERED_IO; //或者是下面的代码，这三句任取其一fdo->Flags |= DO_DIRECT_IO; //<or> fdo->Flags |= 0;
}

PVOID uva;             //  user-mode virtual buffer address
ULONG length;          //  length of user-mode buffer

PVOID sva = ExAllocatePoolWithQuota(NonPagedPoolCacheAligned, length);
if (writing)
{RtlCopyMemory(sva, uva, length);
}
Irp->AssociatedIrp.SystemBuffer = sva; PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(Irp);
if (reading)
{stack->Parameters.Read.Length = length;
}
else
{stack->Parameters.Write.Length = length;
}
<code to send and await IRP>
if (reading)
{RtlCopyMemory(uva, sva, length);
}
ExFreePool(sva);

typedef struct _MDL
{struct _MDL *Next;CSHORT Size;CSHORT MdlFlags;struct _EPROCESS *Process;PVOID MappedSystemVa;PVOID StartVa;ULONG ByteCount;ULONG ByteOffset;
} MDL, *PMDL;

宏或函数    描述
IoAllocateMdl    创建MDL(在文件系统驱动的透明加密中你可能需要创建自己的临时MDL以暂时替换系统的原始的MDL)IoBuildPartialMdl    创建一个已存在MDL的子MDLIoFreeMdl    销毁MDLMmBuildMdlForNonPagedPool    修改MDL以描述内核模式中一个非分页内存区域MmGetMdlByteCount    取缓冲区字节大小MmGetMdlByteOffset    取缓冲区在第一个内存页中的偏移MmGetMdlVirtualAddress    取虚拟地址MmGetSystemAddressForMdl    创建映射到同一内存位置的内核模式虚拟地址MmGetSystemAddressForMdlSafe    与MmGetSystemAddressForMdl相同，但Windows 2000首选MmInitializeMdl    (再)初始化MDL以描述一个给定的虚拟缓冲区MmPrepareMdlForReuse    再初始化MDLMmProbeAndLockPages    地址有效性校验后锁定内存页MmSizeOfMdl    取为描述一个给定的虚拟缓冲区的MDL所占用的内存大小MmUnlockPages    为该MDL解锁内存页

KPROCESSOR_MODE mode;   //  either KernelMode or UserMode
PMDL mdl = IoAllocateMdl(uva, length, FALSE, TRUE, Irp);
MmProbeAndLockPages(mdl, mode, reading ? IoWriteAccess : IoReadAccess); <code to send and await IRP>MmUnlockPages(mdl);
ExFreePool(mdl);

ULONG length = MmGetMdlByteCount(mdl);

Irp->UserBuffer = uva;
PIO_STACK_LOCATION stack = IoGetNextIrpStackLocation(Irp);
if (reading)stack->Parameters.Read.Length = length;
elsestack->Parameters.Write.Length = length; <code to send and await IRP>

File system drivers use this field, which is read-only for all drivers.
Network and, possibly, highest-level device drivers also might read this field,
which can be set with one or more of the following system-defined masks:

IRP_NOCACHE
IRP_PAGING_IO
IRP_MOUNT_COMPLETION
IRP_SYNCHRONOUS_API
IRP_ASSOCIATED_IRP
IRP_BUFFERED_IO
IRP_DEALLOCATE_BUFFER
IRP_INPUT_OPERATION
IRP_SYNCHRONOUS_PAGING_IO
IRP_CREATE_OPERATION
IRP_READ_OPERATION
IRP_WRITE_OPERATION
IRP_CLOSE_OPERATION
IRP_DEFER_IO_COMPLETION

//设备标志的复制
if (FlagOn( DeviceObject->Flags, DO_BUFFERED_IO ))
{SetFlag( SFilterDeviceObject->Flags, DO_BUFFERED_IO );
}
if (FlagOn( DeviceObject->Flags, DO_DIRECT_IO ))
{SetFlag( SFilterDeviceObject->Flags, DO_DIRECT_IO );
} 

typedef struct _IO_STATUS_BLOCK
{union {NTSTATUS  Status;PVOID  Pointer;};ULONG_PTR  Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

If set to TRUE, a driver has marked the IRP pending.
Each IoCompletion routine should check the value of this flag.
If the flag is TRUE, and if the IoCompletion routine will not return STATUS_MORE_PROCESSING_REQUIRED,
the routine should call IoMarkIrpPending to propagate the pending status to drivers above it in the device stack. 

....
Kevent event;
KeInitializeEvent(&event, NotificatinoEvent, FALSE);
IoCopyCurrentIrpStackLocationToNext(Irp);
//设置完成回调函数
IoSetCompletionRoutine(Irp,IrpComplete, //回调函数&event,TRUE,TRUE,TRUE
);
status = IoCallDriver(DeviceObject, Irp);
if(status == STATUS_PENDING)
{//code to handle asynchronous response//异步 status = KeWaitForSingleObject( &waitEvent,Executive,KernelMode,FALSE,NULL );}
...//这是一个IRP完成回调函数的原型
NTSTATUS IrpComplete(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp,IN PVOID Context
)
{...if(Irp->PendingReturned){//这个函数等价于: Irp->IoStatus.Status = STATUS_PENDING 即表名这个IRP处理流程依旧没有结束
        IoMarkIrpPending(Irp);}return Irp->IoStatus.Status;
}

在驱动程序将IRP传递给下一个驱动之后，就不再拥有这个IRP，并且不能视图再去访问这个IRP，否则会导致系统崩溃。那个IRP会被其他的驱动或者线程释放或这直接完成。

这我们要理清一下思路: 我们知道，IRP在设备栈中逐级向下传递，并根据情况可能逐级的设置回调函数，
一直到最底层的真实设备完成了请求。
之后，系统会有一个"回卷"操作，类似我们在C编程中的函数栈的调用迭代的模型。
逐级的"回卷"过程就是不断调用上层驱动设置的回调函数的过程。
也就是不断触发IoCompletion函数的过程，上层驱动通过IoCompletion来获得对之前下发的IRP的重新控制权。一个IoCompletion例程能够返回两个状态值中的任一个:
1. STATUS_PENDING--继续向上完成特定IRP。I/O管理器提升IRP栈指针，并且调用上一个驱动的IoCompletion例程(继续回卷)
2. STATUS_MORE_PROCESSING_REQUIRED--中断向上完成特定IRP的过程，并且把IRP栈指针留在当前位置(暂时中断回卷)。
返回这一状态的驱动通常会在过后调用IoCompleteRequest例程来重新开始向上完成特定的IRP的过程。

完成IRP时是忽略还是拷贝当前栈空间(IO_STACK_LOCATION)，返回什么状态
值，以及完成函数中如何结束IRP，我们这里做个总结。
1) 如果对IRP完成之后的事情无兴趣，则直接忽略当前IO_STACK_LOCATION(即
调用内核API函数IoSkipCurrentIrpStackLocation)，然后向下传递请求，返回IoCallDriver所返回的状态。2) 不但对IRP完成之后的事情无兴趣，而且不打算立刻返回成功或失败(即挡在当前这
一层的驱动这里，不再往下传递了)。那么不用忽略或者拷贝当前IO_STACK_LOCATION，填写IRP的状态参数后调用IoCompleteRequest，
并返回自己想返回的结果。3) 如果对IRP完成之后的事情有兴趣，并打算在完成函数中处理，则应该首先拷贝当
前IO_STACK_LOCATION(IoCopyCurrentIrpStackLocationToNext)，然后指定完成函数，并返回IoCallDriver()所返回的状态。在完成函数中，不需要调用
IoCompleteRequest，直接返回IRP的当前状态即可4) 如果对IRP完成之后的事情有兴趣，并打算在完成函数中处理，有时候会把任务塞
进系统工作线程或者希望在另外的线程中去完成IRP，那么完成函数中应该返回STATUS_MORE_PROCESSING_REQUIRED，此时完成IRP时应该调用
IoCompleteRequest。另一种类似的情况是在分发函数中等待完成函数中设置事件，那么完成函数返回STATUS_MORE_PROCESSING_REQUIRED，分发函数
在等待结束后调用IoCompleteRequest。

BOOLEAN  Cancel;
KIRQL  CancelIrql;
.
.
PDRIVER_CANCEL  CancelRoutine;

PDRIVER_CANCEL IoSetCancelRoutine(IN PIRP  Irp,IN PDRIVER_CANCEL  CancelRoutine); VOID IoAcquireCancelSpinLock(OUT PKIRQL  Irql);

1. 上层的驱动通过调用 IoCancelIrp(Irp)来取消某个请求。这个请求应该是被某个下层驱动放在缓冲队列中等待处理或正在处理。2. 下层驱动为了能支持驱动取消机制，一般都在收到IRP请求时就马上注册一个取消回调例程 CancelRoutine，注册的函数是 IoSetCancelRoutine(Irp, CancelRoutine)3. IoCancelIrp 调用中就会去先调用 IoAcquireCancelSpinLock，再调用这个设置好的CancelRoutine4. CancelRoutine中，驱动一般会根据当前Irp的状态来做相应的操作。如果Irp是在请
求队列中，就会先将它移出队列，设置好返回状态STATUS_CANCELLED，然后再调用IoCompleteRequest来直接完成这个请求，最后千万不要忘记调用
IoReleaseCancelSpinLock(Irp的CancelIrql)来释放自旋锁。

union
{struct {..union {KDEVICE_QUEUE_ENTRY DeviceQueueEntry;struct {PVOID  DriverContext[4];};};..PETHREAD  Thread;..LIST_ENTRY  ListEntry;..} Overlay;..
} Tail;

PIO_STACK_LOCATION IoGetCurrentIrpStackLocation(IN PIRP  Irp);

typedef struct _IO_STACK_LOCATION
{UCHAR  MajorFunction;UCHAR  MinorFunction;UCHAR  Flags;UCHAR  Control;union {//// Parameters for IRP_MJ_CREATE //
        struct {PIO_SECURITY_CONTEXT  SecurityContext;ULONG  Options;USHORT POINTER_ALIGNMENT  FileAttributes;USHORT  ShareAccess;ULONG POINTER_ALIGNMENT  EaLength;} Create;//// Parameters for IRP_MJ_READ //
        struct {ULONG  Length;ULONG POINTER_ALIGNMENT  Key;LARGE_INTEGER  ByteOffset;} Read;//// Parameters for IRP_MJ_WRITE //
        struct {ULONG  Length;ULONG POINTER_ALIGNMENT  Key;LARGE_INTEGER  ByteOffset;} Write;//// Parameters for IRP_MJ_QUERY_INFORMATION //
        struct {ULONG  Length;FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;} QueryFile;//// Parameters for IRP_MJ_SET_INFORMATION //
        struct {ULONG  Length;FILE_INFORMATION_CLASS POINTER_ALIGNMENT  FileInformationClass;PFILE_OBJECT  FileObject;union {struct {BOOLEAN  ReplaceIfExists;BOOLEAN  AdvanceOnly;};ULONG  ClusterCount;HANDLE  DeleteHandle;};} SetFile;//// Parameters for IRP_MJ_QUERY_VOLUME_INFORMATION //
        struct {ULONG  Length;FS_INFORMATION_CLASS POINTER_ALIGNMENT  FsInformationClass;} QueryVolume;//// Parameters for IRP_MJ_DEVICE_CONTROL and IRP_MJ_INTERNAL_DEVICE_CONTROL //
        struct {ULONG  OutputBufferLength;ULONG POINTER_ALIGNMENT  InputBufferLength;ULONG POINTER_ALIGNMENT  IoControlCode;PVOID  Type3InputBuffer;} DeviceIoControl;//// Nonsystem service parameters.//// Parameters for IRP_MN_MOUNT_VOLUME //
        struct {PVOID  DoNotUse1;PDEVICE_OBJECT  DeviceObject;} MountVolume;//// Parameters for IRP_MN_VERIFY_VOLUME //
        struct {PVOID  DoNotUse1;PDEVICE_OBJECT  DeviceObject;} VerifyVolume;//// Parameters for Scsi using IRP_MJ_INTERNAL_DEVICE_CONTROL //
        struct { struct _SCSI_REQUEST_BLOCK  *Srb;} Scsi;//// Parameters for IRP_MN_QUERY_DEVICE_RELATIONS //
        struct {DEVICE_RELATION_TYPE  Type;} QueryDeviceRelations;//// Parameters for IRP_MN_QUERY_INTERFACE //
        struct {CONST GUID  *InterfaceType;USHORT  Size;USHORT  Version;PINTERFACE  Interface;PVOID  InterfaceSpecificData;} QueryInterface;//// Parameters for IRP_MN_QUERY_CAPABILITIES //
        struct {PDEVICE_CAPABILITIES  Capabilities;} DeviceCapabilities;//// Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS //
        struct {PIO_RESOURCE_REQUIREMENTS_LIST  IoResourceRequirementList;} FilterResourceRequirements;//// Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG //
        struct {ULONG  WhichSpace;PVOID  Buffer;ULONG  Offset;ULONG  POINTER_ALIGNMENT Length;} ReadWriteConfig;//// Parameters for IRP_MN_SET_LOCK //
        struct {BOOLEAN  Lock;} SetLock;//// Parameters for IRP_MN_QUERY_ID //
        struct {BUS_QUERY_ID_TYPE  IdType;} QueryId;//// Parameters for IRP_MN_QUERY_DEVICE_TEXT //
        struct {DEVICE_TEXT_TYPE  DeviceTextType;LCID POINTER_ALIGNMENT  LocaleId;} QueryDeviceText;//// Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION //
        struct {BOOLEAN  InPath;BOOLEAN  Reserved[3];DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;} UsageNotification;//// Parameters for IRP_MN_WAIT_WAKE //
        struct {SYSTEM_POWER_STATE  PowerState;} WaitWake;//// Parameter for IRP_MN_POWER_SEQUENCE //
        struct {PPOWER_SEQUENCE  PowerSequence;} PowerSequence;//// Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER //
        struct {ULONG  SystemContext;POWER_STATE_TYPE POINTER_ALIGNMENT  Type;POWER_STATE POINTER_ALIGNMENT  State;POWER_ACTION POINTER_ALIGNMENT  ShutdownType;} Power;//// Parameters for IRP_MN_START_DEVICE //
        struct {PCM_RESOURCE_LIST  AllocatedResources;PCM_RESOURCE_LIST  AllocatedResourcesTranslated;} StartDevice;//// Parameters for WMI Minor IRPs //
        struct {ULONG_PTR  ProviderId;PVOID  DataPath;ULONG  BufferSize;PVOID  Buffer;} WMI;//// Others - driver-specific//
        struct {PVOID  Argument1;PVOID  Argument2;PVOID  Argument3;PVOID  Argument4;} Others;} Parameters;PDEVICE_OBJECT  DeviceObject;PFILE_OBJECT  FileObject;...
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;

UCHAR  MajorFunction;
UCHAR  MinorFunction;

NTSTATUS
DriverEntry (IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{...DriverObject->MajorFunction[IRP_MJ_CREATE] = SfCreate;DriverObject->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE] = SfCreate;DriverObject->MajorFunction[IRP_MJ_CREATE_MAILSLOT] = SfCreate;DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = SfFsControl;DriverObject->MajorFunction[IRP_MJ_CLEANUP] = SfCleanupClose;DriverObject->MajorFunction[IRP_MJ_CLOSE] = SfCleanupClose;...
}

IRP_MJ_CREATE
IRP_MJ_PNP
IRP_MJ_POWER
IRP_MJ_READ
IRP_MJ_WRITE
IRP_MJ_FLUSH_BUFFERS
IRP_MJ_QUERY_INFORMATION
IRP_MJ_SET_INFORMATION
IRP_MJ_DEVICE_CONTROL
IRP_MJ_INTERNAL_DEVICE_CONTROL
IRP_MJ_SYSTEM_CONTROL
IRP_MJ_CLEANUP
IRP_MJ_CLOSE
IRP_MJ_SHUTDOWN 

switch (irpSp->MinorFunction) { //磁盘卷挂载case IRP_MN_MOUNT_VOLUME: return SfFsControlMountVolume( DeviceObject, Irp );  //磁盘卷加载case IRP_MN_LOAD_FILE_SYSTEM: return SfFsControlLoadFileSystem( DeviceObject, Irp );//磁盘的请求case IRP_MN_USER_FS_REQUEST:{switch (irpSp->Parameters.FileSystemControl.FsControlCode) { case FSCTL_DISMOUNT_VOLUME:{..}}break;}}        

typedef struct _FILE_OBJECT
{CSHORT  Type;CSHORT  Size;PDEVICE_OBJECT  DeviceObject;PVPB  Vpb;PVOID  FsContext;PVOID  FsContext2;PSECTION_OBJECT_POINTERS  SectionObjectPointer;PVOID  PrivateCacheMap;NTSTATUS  FinalStatus;struct _FILE_OBJECT  *RelatedFileObject;BOOLEAN  LockOperation;BOOLEAN  DeletePending;BOOLEAN  ReadAccess;BOOLEAN  WriteAccess;BOOLEAN  DeleteAccess;BOOLEAN  SharedRead;BOOLEAN  SharedWrite;BOOLEAN  SharedDelete;ULONG  Flags;UNICODE_STRING  FileName;LARGE_INTEGER  CurrentByteOffset;ULONG  Waiters;ULONG  Busy;PVOID  LastLock;KEVENT  Lock;KEVENT  Event;PIO_COMPLETION_CONTEXT  CompletionContext;KSPIN_LOCK  IrpListLock;LIST_ENTRY  IrpList;PVOID  FileObjectExtension;
} FILE_OBJECT, *PFILE_OBJECT;