StartIO主要保证 各个运行的IRP顺序执行,即串行化
用系统定义的StartIO例程只能使用一个队列,这个队列会将所有的IRP进行处理
读写操作 都会混在一起进行串行处理,但我们需要将读写分别进行串行处理 ,就需要自定义StartIo
当自定义StartIO时,需要我们自己负责”入队“ + ”出队“
使用前初始化队列:
VOID
KeInitializeDeviceQueue( //在初始化设备的时候 初始化队列
IN PKDEVICE_QUEUE DeviceQueue
);
typedef struct _KDEVICE_QUEUE { //IRP队列来实现串行
CSHORT Type;
CSHORT Size;
LIST_ENTRY devicelisthead;
KSPIN_LOCK Lock;
BOOLEAN Busy;
} KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;
typedef struct _KDEVICE_QUEUE_ENTRY { //队列中每个元素都用这个数据结构来表示
LIST_ENTRY DeviceListEntry;
ULONG SortKey;
BOOLEAN Inserted;
} KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY, *PRKDEVICE_QUEUE_ENTRY;
BOOLEAN //返回BOOL 如果当前设备不忙,则可以直接处理该IRP,因此这时候不需要插入队列,返回FALSE,调用我们的例程 如果设备正在处理,需要将IRP插入队列,这时候返回TRUE
KeInsertDeviceQueue( //插入队列的函数
IN PKDEVICE_QUEUE DeviceQueue, //被插入队列
IN PKDEVICE_QUEUE_ENTRY DeviceQueueEntry //插入原始
);
PKDEVICE_QUEUE_ENTRY
KeRemoveDeviceQueue(
IN PKDEVICE_QUEUE DeviceQueue //指定从哪个队列中取出元素
);
VOID
KeRaiseIrql( //提升权限
IN KIRQL NewIrql, //这里可以设置 DISPATCH_LEVEL
OUT PKIRQL OldIrql //这里是自定义的 KIRQL oldirql
);
VOID
KeLowerIrql(
IN KIRQL NewIrql
);
示例:
1)首先在设备扩展中加入 KEVICE_QUEUE 数据结构存储队列,并且在 DriverEntry中初始化该队列
如果我们需要对读写操作分别串行化,那么在设备扩展中创建两个队列,分别对读和写
2)编写派遣函数 首先用 IoMarkIrpPending 将IRP挂起,然后准备将IRP进行队列
3)在进入队列前,将当前的IRQL提升到 DISPATCH_LEVEL
4)插入队列,返回值指示是否需要立即执行,FALSE->IRP没有被插入到队列,而是需要被立刻结束,这时候 调用自定义的StartIO例程
00000000 0.00000000Enter DriverEntry
00000001 0.00007962Leave DriverEntry
00000002 3.99192595Enter HelloDDKDispatchRoutin
00000003 3.99193692IRP_MJ_CREATE
00000004 3.99239373Leave HelloDDKDispatchRoutin
00000005 3.99388027Enter HelloDDKRead
00000006 3.99389243HelloDDKRead irp :856658d8
00000007 3.99389529DeviceQueueEntry:85665918
00000008 3.99389815 不忙不需要插入例程 调用我们的例程
00000009 3.99390054Enter MyStartIo
00000010 3.99390268等3秒
00000011 3.99449444Enter HelloDDKRead //
00000012 3.99449825HelloDDKRead irp :861fa510 等待3秒时进行下一线程的进行
00000013 3.99450088DeviceQueueEntry:861fa550
00000014 3.99450326忙 插入例程到队列 这时候 当前设备正在操作线程1 忙 所以插入队列
00000015 3.99450636Leave HelloDDKRead //
00000016 6.994039543秒结束
00000017 6.99406052Complete a irp:856658d8
00000018 6.99421740device_entry:861fa550
00000019 6.99421978循环一次 //循环取队列 看是否空 不空就再来一次
00000020 6.99422169等3秒
00000021 9.994337083秒结束
00000022 9.99434948Complete a irp:861fa510
00000023 9.99453259device_entry:0
00000024 9.99453640device_entry 为空 //空 就结束 自定义StartIO例程
00000025 9.99453831Leave MyStartIo
00000026 9.99454212忙 插入例程到队列 //这里是因为没有例程了 所以返回失败 ················
00000027 9.99456406Leave HelloDDKRead
00000028 9.99637890Enter HelloDDKDispatchRoutin
00000029 9.99638176IRP_MJ_CLEANUP
00000030 9.99684811Leave HelloDDKDispatchRoutin
00000031 9.99746609Enter HelloDDKDispatchRoutin
00000032 9.99746990IRP_MJ_CLOSE
00000033 9.99793625Leave HelloDDKDispatchRoutin
驱动程序代码:
#include "Driver.h"
#pragma LOCKEDCODE //让函数运行在非分页内存中
VOID
MyStartIo(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP pFistIrp
)
{
KdPrint(("Enter MyStartIo\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
DeviceObject->DeviceExtension;
PKDEVICE_QUEUE_ENTRY device_entry;
PIRP Irp = pFistIrp;
do
{
KEVENT event;
KeInitializeEvent(&event,NotificationEvent,FALSE);
//等3秒
KdPrint(("等3秒\n"));
LARGE_INTEGER timeout;
timeout.QuadPart = -3*1000*1000*10;
//定义一个3秒的延时,主要是为了模拟该IRP操作需要大概3秒左右时间
KeWaitForSingleObject(&event,Executive,KernelMode,FALSE,&timeout);
KdPrint(("3秒结束\n"));
KdPrint(("Complete a irp:%x\n",Irp));
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0; // no bytes xfered
IoCompleteRequest(Irp,IO_NO_INCREMENT);
device_entry=KeRemoveDeviceQueue(&pDevExt->device_queue);
KdPrint(("device_entry:%x\n",device_entry));
if (device_entry==NULL)
{
KdPrint(("device_entry 为空\n"));
break;
}
Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);
KdPrint(("循环一次\n")); //循环取队列 看是否为空 不为空 就是后面还有例程
}while(1);
KdPrint(("Leave MyStartIo\n"));
}
/************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序,定位和申请硬件资源,创建内核对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
IN PDRIVER_OBJECT pDriverObject,
IN PUNICODE_STRING pRegistryPath )
{
NTSTATUS status;
KdPrint(("Enter DriverEntry\n"));
//设置卸载函数
pDriverObject->DriverUnload = HelloDDKUnload;
//设置派遣函数
pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKRead;
pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = HelloDDKDispatchRoutin;
pDriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = HelloDDKDispatchRoutin;
//创建驱动设备对象
status = CreateDevice(pDriverObject);
KdPrint(("Leave DriverEntry\n"));
return status;
}
/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
IN PDRIVER_OBJECT pDriverObject)
{
NTSTATUS status;
PDEVICE_OBJECT pDevObj;
PDEVICE_EXTENSION pDevExt;
//创建设备名称
UNICODE_STRING devName;
RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");
//创建设备
status = IoCreateDevice( pDriverObject,
sizeof(DEVICE_EXTENSION),
&(UNICODE_STRING)devName,
FILE_DEVICE_UNKNOWN,
0, TRUE,
&pDevObj );
if (!NT_SUCCESS(status))
return status;
pDevObj->Flags |= DO_BUFFERED_IO;
pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
pDevExt->pDevice = pDevObj;
pDevExt->ustrDeviceName = devName;
RtlZeroBytes(&pDevExt->device_queue,sizeof(pDevExt->device_queue));
KeInitializeDeviceQueue(&pDevExt->device_queue);
//创建符号链接
UNICODE_STRING symLinkName;
RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");
pDevExt->ustrSymLinkName = symLinkName;
status = IoCreateSymbolicLink( &symLinkName,&devName );
if (!NT_SUCCESS(status))
{
IoDeleteDevice( pDevObj );
return status;
}
return STATUS_SUCCESS;
}
/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject)
{
PDEVICE_OBJECT pNextObj;
KdPrint(("Enter DriverUnload\n"));
pNextObj = pDriverObject->DeviceObject;
while (pNextObj != NULL)
{
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pNextObj->DeviceExtension;
//删除符号链接
UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
IoDeleteSymbolicLink(&pLinkName);
pNextObj = pNextObj->NextDevice;
IoDeleteDevice( pDevExt->pDevice );
}
}
/************************************************************************
* 函数名称:HelloDDKDispatchRoutin
* 功能描述:对读IRP进行处理
* 参数列表:
pDevObj:功能设备对象
pIrp:从IO请求包
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKDispatchRoutin\n"));
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
//建立一个字符串数组与IRP类型对应起来
static char* irpname[] =
{
"IRP_MJ_CREATE",
"IRP_MJ_CREATE_NAMED_PIPE",
"IRP_MJ_CLOSE",
"IRP_MJ_READ",
"IRP_MJ_WRITE",
"IRP_MJ_QUERY_INFORMATION",
"IRP_MJ_SET_INFORMATION",
"IRP_MJ_QUERY_EA",
"IRP_MJ_SET_EA",
"IRP_MJ_FLUSH_BUFFERS",
"IRP_MJ_QUERY_VOLUME_INFORMATION",
"IRP_MJ_SET_VOLUME_INFORMATION",
"IRP_MJ_DIRECTORY_CONTROL",
"IRP_MJ_FILE_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CONTROL",
"IRP_MJ_INTERNAL_DEVICE_CONTROL",
"IRP_MJ_SHUTDOWN",
"IRP_MJ_LOCK_CONTROL",
"IRP_MJ_CLEANUP",
"IRP_MJ_CREATE_MAILSLOT",
"IRP_MJ_QUERY_SECURITY",
"IRP_MJ_SET_SECURITY",
"IRP_MJ_POWER",
"IRP_MJ_SYSTEM_CONTROL",
"IRP_MJ_DEVICE_CHANGE",
"IRP_MJ_QUERY_QUOTA",
"IRP_MJ_SET_QUOTA",
"IRP_MJ_PNP",
};
UCHAR type = stack->MajorFunction;
if (type >= arraysize(irpname))
KdPrint((" - Unknown IRP, major type %X\n", type));
else
KdPrint(("\t%s\n", irpname[type]));
//对一般IRP的简单操作,后面会介绍对IRP更复杂的操作
NTSTATUS status = STATUS_SUCCESS;
// 完成IRP
pIrp->IoStatus.Status = status;
pIrp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( pIrp, IO_NO_INCREMENT );
KdPrint(("Leave HelloDDKDispatchRoutin\n"));
return status;
}
VOID
OnCancelIRP(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
KdPrint(("Enter CancelReadIRP\n"));
//释放Cancel自旋锁
IoReleaseCancelSpinLock(Irp->CancelIrql);
//设置完成状态为STATUS_CANCELLED
Irp->IoStatus.Status = STATUS_CANCELLED;
Irp->IoStatus.Information = 0; // bytes xfered
IoCompleteRequest( Irp, IO_NO_INCREMENT );
KdPrint(("Leave CancelReadIRP\n"));
}
NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp)
{
KdPrint(("Enter HelloDDKRead\n"));
PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
pDevObj->DeviceExtension;
//将IRP设置为挂起
IoMarkIrpPending(pIrp);
IoSetCancelRoutine(pIrp,OnCancelIRP); //设置取消IRP的例程 这里没有被调用到
KIRQL oldirql;
//提升IRP至DISPATCH_LEVEL
KeRaiseIrql(DISPATCH_LEVEL, &oldirql);
KdPrint(("HelloDDKRead irp :%x\n",pIrp));
KdPrint(("DeviceQueueEntry:%x\n",&pIrp->Tail.Overlay.DeviceQueueEntry));
if (!KeInsertDeviceQueue(&pDevExt->device_queue, &pIrp->Tail.Overlay.DeviceQueueEntry))
{
KdPrint(("不忙 不需要插入例程 调用我们的例程\n"));
MyStartIo(pDevObj,pIrp);
}
KdPrint(("忙 插入例程到队列\n"));
//将IRP降至原来IRQL
KeLowerIrql(oldirql);
KdPrint(("Leave HelloDDKRead\n"));
//返回pending状态
return STATUS_PENDING;
}
应用程序代码:
#include <windows.h>
#include <stdio.h>
#include <process.h>
UINT WINAPI Thread(LPVOID context)
{
printf("Enter Thread\n");
OVERLAPPED overlap={0};
overlap.hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);
UCHAR buffer[10];
ULONG ulRead;
BOOL bRead = ReadFile(*(PHANDLE)context,buffer,10,&ulRead,&overlap);
WaitForSingleObject(overlap.hEvent,INFINITE);
printf("Leave Thread\n");
return 0;
}
int main()
{
HANDLE hDevice =
CreateFile("\\\\.\\HelloDDK",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OVERLAPPED,//此处设置FILE_FLAG_OVERLAPPED
NULL );
if (hDevice == INVALID_HANDLE_VALUE)
{
printf("Open Device failed!");
return 1;
}
HANDLE hThread[2];
hThread[0] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);
hThread[1] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);
//主线程等待两个子线程结束
WaitForMultipleObjects(2,hThread,TRUE,INFINITE);
printf("Two Thread over!\n");
//创建IRP_MJ_CLEANUP IRP
CloseHandle(hDevice);
return 0;
}