关于IoCallDriver

通常我们所知IoCallDriver是把irp传递给下一层设备，传递到底是什么意思呢？
IoCallDriver中实际调用了IopfCallDriver，其代码如下：
NTSTATUS
FORCEINLINE
IopfCallDriver(
    IN PDEVICE_OBJECT DeviceObject,
    IN OUT PIRP Irp
    )

/*++

Routine Description:

This routine is invoked to pass an I/O Request Packet (IRP) to another
    driver at its dispatch routine.

Arguments:

DeviceObject - Pointer to device object to which the IRP should be passed.

Irp - Pointer to IRP for request.

Return Value:

Return status from driver's dispatch routine.

--*/

{
    PIO_STACK_LOCATION irpSp;
    PDRIVER_OBJECT driverObject;
    NTSTATUS status;

//
    // Ensure that this is really an I/O Request Packet.
    //

ASSERT( Irp->Type == IO_TYPE_IRP );

//
    // Update the IRP stack to point to the next location.
    //
    Irp->CurrentLocation--;

if (Irp->CurrentLocation <= 0) {
        KiBugCheck3( NO_MORE_IRP_STACK_LOCATIONS, (ULONG_PTR) Irp, 0, 0 );
    }

irpSp = IoGetNextIrpStackLocation( Irp );
    Irp->Tail.Overlay.CurrentStackLocation = irpSp;

//
    // Save a pointer to the device object for this request so that it can
    // be used later in completion.
    //

irpSp->DeviceObject = DeviceObject;

//
    // Invoke the driver at its dispatch routine entry point.
    //

driverObject = DeviceObject->DriverObject;

//
    // Prevent the driver from unloading.
    //

status = driverObject->MajorFunction[irpSp->MajorFunction]( DeviceObject,
                                                              Irp );

return status;
}

可以看到，IopfCallDriver首先将irp的当前位置减一，即得到下一个位置。而IoGetNextIrpStackLocation是一个宏，得到下一个irp堆栈的指针，并将这一指针身为当前irp堆栈指针。实际上就是irp->Tail.Overlay.CurrentStackLocation - 1。然后从该irp堆栈中取出它所对应的device object，从而得到driver object。最后，传递irp实际上就是调用对应这次请求的例程。这个请求或者从irp堆栈中取出一些参数，或者干些其他什么事，这我们就不管了。
 
再有就是有关于完成例程IoCompletionRoutine，它是如何被调用的？当完成一个irp时，我们会呼叫IoCompleteRequest。这个函数遍历一遍irp堆栈，如果发现堆栈中设置了IoCompletionRoutine指针，就调用它。