Edit

Share via

Processing WMI IRPs in a DispatchSystemControl Routine

  • Article

A driver that handles WMI IRPs in its DispatchSystemControl routine must handle such an IRP only if the device object pointer at Parameters.WMI.ProviderId matches the pointer passed by the driver in its call to IoWMIRegistrationControl. Otherwise, the driver must forward the IRP to the next lower driver.

If the driver handles the request, it must:

Check the GUID at Parameters.WMI.DataPath to determine whether it represents a data block supported by the driver and, if not, fail the IRP with STATUS_WMI_GUID_NOT_FOUND.

A driver should check the input WNODE_XXX structure at Parameters.WMI.Buffer for the instance name when handling any of the following requests:

IRP_MN_QUERY_SINGLE_INSTANCE IRP_MN_CHANGE_SINGLE_INSTANCE IRP_MN_CHANGE_SINGLE_ITEM IRP_MN_EXECUTE_METHOD The driver should check for the instance name as follows:

  • If WNODE_FLAG_STATIC_INSTANCE_NAMES is set in WnodeHeader.Flags, use InstanceIndex as an index into the driver's list of static instance names for that block.

  • If WNODE_FLAG_STATIC_INSTANCE_NAMES is clear in WnodeHeader.Flags, use OffsetInstanceName as an offset to the instance name string in the input WNODE_XXX structure. OffsetInstanceName is the offset in bytes from the beginning of the structure to a USHORT that indicates the length of the instance name string in bytes (not characters), including the NUL terminator if present, followed by the string itself in Unicode.

If the driver cannot locate the instance specified by InstanceIndex or OffsetInstanceName, it must fail the IRP with STATUS_WMI_INSTANCE_NOT_FOUND.

For an IRP_MN_EXECUTE_METHOD request, check MethodID in the input WNODE_METHOD_ITEM and, if the method is not valid for that data block, fail the IRP with STATUS_WMI_ITEMID_NOT_FOUND.

If the request generates output, a driver should check the size of the buffer at Parameters.WMI.BufferSize when handling any of the following requests:

IRP_MN_QUERY_ALL_DATA IRP_MN_QUERY_SINGLE_INSTANCE IRP_MN_EXECUTE_METHOD If the buffer is too small to receive the output, but at least sizeof(WNODE_TOO_SMALL), the driver should succeed the IRP and write a WNODE_TOO_SMALL structure to the buffer at Parameters.WMI.Buffer. If the buffer is smaller than sizeof(WNODE_TOO_SMALL), the driver fails the IRP with an NTSTATUS code of STATUS_BUFFER_TOO_SMALL.

If the request generates output and the buffer size is adequate, write the following output to the buffer at Parameters.WMI.Buffer:

  • For an IRP_MN_QUERY_ALL_DATA request, the driver writes a WNODE_ALL_DATA structure that contains data for all instances of the specified data block.
  • For an IRP_MN_QUERY_SINGLE_INSTANCE request, the driver writes a WNODE_SINGLE_INSTANCE structure that contains data for the specified instance of a data block.
  • For an IRP_MN_EXECUTE_METHOD if the method generates output, the driver writes the method output in driver-determined format following the input WNODE_METHOD_ITEM in the buffer (overwriting input data, if any).

Set Irp->IoStatus.Information to the number of bytes written to the buffer at Parameters.WMI.Buffer and Irp->IoStatus.Status to STATUS_SUCCESS.

Call IoCompleteRequest to complete the IRP.

For more information, see WMI WNODE_XXX Structures.