读wrk系列关于IRP（1）

最新推荐文章于 2022-05-09 15:57:32 发布

Shevacoming

最新推荐文章于 2022-05-09 15:57:32 发布

阅读量2.5k

点赞数

分类专栏：内核研究文章标签： object null processing structure compiler integer

本文链接：https://blog.csdn.net/shevacoming/article/details/7952717

版权

本文详细解析了Windows驱动中IRP（I/O请求包）的处理过程，从NtReadFile开始，包括建立IRP、派发、完成及取消IO等关键步骤。特别提到ClassRead函数中的IoMarkIrpPending和IoStartPacket，以及在IRP完成阶段的处理细节和技巧，如IoCompletion例程的使用规定和影响。

摘要由CSDN通过智能技术生成

NtReadFile为例，

1. 建立irp

PIRP
IopAllocateIrpPrivate(
    IN CCHAR StackSize,
    IN BOOLEAN ChargeQuota
)

//如果大小小于IopLargeIrpStackLocations，那么从prcb->PPLookasideList[number].P;这个快查表里面拿一个，如果大于这个值则构造一个

//然后初始化
#define IopInitializeIrp( Irp, PacketSize, StackSize ) {          \
    RtlZeroMemory( (Irp), (PacketSize) );                         \
    (Irp)->Type = (CSHORT) IO_TYPE_IRP;                           \
    (Irp)->Size = (USHORT) ((PacketSize));                        \
    (Irp)->StackCount = (CCHAR) ((StackSize));                    \
    (Irp)->CurrentLocation = (CCHAR) ((StackSize) + 1);           \
    (Irp)->ApcEnvironment = KeGetCurrentApcEnvironment();         \
    InitializeListHead (&(Irp)->ThreadListEntry);                 \
    (Irp)->Tail.Overlay.CurrentStackLocation =                    \
        ((PIO_STACK_LOCATION) ((UCHAR *) (Irp) +                  \
            sizeof( IRP ) +                                       \
            ( (StackSize) * sizeof( IO_STACK_LOCATION )))); }

2.调用IopSynchronousServiceTail派发irp

NTSTATUS
IopSynchronousServiceTail(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp,
    IN PFILE_OBJECT FileObject,
    IN BOOLEAN DeferredIoCompletion,
    IN KPROCESSOR_MODE RequestorMode,
    IN BOOLEAN SynchronousIo,
    IN TRANSFER_TYPE TransferType
    )

{
    NTSTATUS status;
    PAGED_CODE();

//异步操作要插入irp的thread->irpList

    if (!SynchronousIo) {
        IopQueueThreadIrp( Irp );
    }
//……
    //
    // 向设备发irp
    //

    status = IoCallDriver( DeviceObject, Irp );

    if (DeferredIoCompletion) {

        if (status != STATUS_PENDING) {

            PKNORMAL_ROUTINE normalRoutine;
            PVOID normalContext;
            KIRQL irql = PASSIVE_LEVEL; // Just to shut up the compiler

            ASSERT( !Irp->PendingReturned );

            if (!SynchronousIo) {
                KeRaiseIrql( APC_LEVEL, &irql );
            }
    //完成请求
        IopCompleteRequest( &Irp->Tail.Apc,
                                &normalRoutine,
                                &normalContext,
                                (PVOID *) &FileObject,
                                &normalContext );

            if (!SynchronousIo) {
                KeLowerIrql( irql );
            }
        }
    }
//同步下等待irp完成
    if (SynchronousIo) {

        if (status == STATUS_PENDING) {