学步园

      刚看完FileDisk代码,感受颇多,其中采用线程的方式进行IRP序列化更是让人觉得新鲜.在DDK中一般采用StartIo来进行IRP的序列话,其中在入口函数中加入pDriverObject->DriverStartUp = XXXStartIO即可, 当然也没这么简单,其中还要做写处理.

      FileDisk采用了另外一种方法,先来看看代码;

 //为IRP消息而设的双向循环链表结构<br /> InitializeListHead(&device_extension->list_head);<br /> //自旋锁初始化,锁住双向链表,在线程处理中解锁<br /> KeInitializeSpinLock(&device_extension->list_lock);<br /> //设置同步事件<br /> KeInitializeEvent(<br /> &device_extension->request_event,<br /> SynchronizationEvent,//同步事件操作,在每一次wait通过后自动将事件设为未受信状态,<br /> //使下一次wait阻塞.NotificationEvent则不会自动设置,需要手动<br /> FALSE//初始状态为未受信状态<br /> );<br /> //设置线程有效<br /> device_extension->terminate_thread = FALSE;<br /> //建立主线程,实际上一个盘只有一个线程操作<br /> status = PsCreateSystemThread(<br /> &thread_handle,//获得线程句柄<br /> (ACCESS_MASK) 0L,//屏蔽消息<br /> NULL,<br /> NULL,<br /> NULL,<br /> FileDiskThread,//触发磁盘操作线程<br /> device_object<br /> );

    这里可以看出,将FileDisk将IRP包保存在List_head当中,方便于在FileDiskThread线程直接进行处理.接下来看看FileDiskThread线程代码如何实现;

VOID<br /> FileDiskThread (<br /> IN PVOID Context<br /> )<br /> {<br /> PDEVICE_OBJECT device_object;<br /> PDEVICE_EXTENSION device_extension;<br /> PLIST_ENTRY request;//双向链表的IRP栈<br /> PIRP irp;<br /> PIO_STACK_LOCATION io_stack;<br /> PUCHAR system_buffer;<br /> PUCHAR buffer;</p> <p> ASSERT(Context != NULL);//?</p> <p> device_object = (PDEVICE_OBJECT) Context;</p> <p> device_extension = (PDEVICE_EXTENSION) device_object->DeviceExtension;<br /> //设置优先级<br /> KeSetPriorityThread(KeGetCurrentThread(), LOW_REALTIME_PRIORITY);</p> <p> for (;;)//以下为线程的无限循环,当device_extension->terminate_thread设为true时才结束.<br /> {<br /> //等待request_event事件置信,for每循环一次,在这里被阻塞,等待<br /> KeWaitForSingleObject(<br /> &device_extension->request_event,<br /> Executive,<br /> KernelMode,<br /> FALSE,<br /> NULL<br /> );<br /> //如果结束线程标志置位,结束线程<br /> if (device_extension->terminate_thread)<br /> {<br /> PsTerminateSystemThread(STATUS_SUCCESS);<br /> }<br /> //遍历IRP表<br /> while (request = ExInterlockedRemoveHeadList(<br /> &device_extension->list_head,<br /> &device_extension->list_lock<br /> )) //list不为空,则指向下一链表数据<br /> {<br /> irp = CONTAINING_RECORD(request, IRP, Tail.Overlay.ListEntry); //获取irp基地址,tail是IRP结构里面的一个Union结构,Tail.Overlay.ListEntry说明IRP入栈待处理<br /> ////IRP的栈返回形式<br /> io_stack = IoGetCurrentIrpStackLocation(irp);</p> <p> switch (io_stack->MajorFunction)<br /> {<br /> case IRP_MJ_READ://读数据到内存<br /> system_buffer = (PUCHAR) MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);//分配MDL虚拟地址空间<br /> if (system_buffer == NULL)<br /> {<br /> irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;//分配失败返回资源不足警告<br /> irp->IoStatus.Information = 0;<br /> break;<br /> }<br /> buffer = (PUCHAR) ExAllocatePool(PagedPool, io_stack->Parameters.Read.Length); //分配空间<br /> if (buffer == NULL)<br /> {<br /> irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;<br /> irp->IoStatus.Information = 0;<br /> break;<br /> }<br /> ZwReadFile(<br /> device_extension->file_handle, //读取指定的映像文件<br /> NULL,<br /> NULL,<br /> NULL,<br /> &irp->IoStatus,<br /> buffer, //文件缓冲<br /> io_stack->Parameters.Read.Length,<br /> &io_stack->Parameters.Read.ByteOffset,<br /> NULL<br /> );<br /> RtlCopyMemory(system_buffer, buffer, io_stack->Parameters.Read.Length); //将文件缓冲读入到MDL缓冲<br /> ExFreePool(buffer);//释放文件缓冲<br /> break;</p> <p> case IRP_MJ_WRITE://内存数据写到设备<br /> if ((io_stack->Parameters.Write.ByteOffset.QuadPart +<br /> io_stack->Parameters.Write.Length) ><br /> device_extension->file_size.QuadPart)//判错处理<br /> {<br /> irp->IoStatus.Status = STATUS_INVALID_PARAMETER;<br /> irp->IoStatus.Information = 0;<br /> }<br /> ZwWriteFile(<br /> device_extension->file_handle,<br /> NULL,<br /> NULL,<br /> NULL,<br /> &irp->IoStatus,<br /> MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority), //从MDL缓冲写入文件<br /> io_stack->Parameters.Write.Length,<br /> &io_stack->Parameters.Write.ByteOffset,<br /> NULL<br /> ); //写文件<br /> break;<br /> //下面的是自定义IRP响应<br /> case IRP_MJ_DEVICE_CONTROL:<br /> switch (io_stack->Parameters.DeviceIoControl.IoControlCode)<br /> {<br /> case IOCTL_FILE_DISK_OPEN_FILE:<br /> //nt未公开函数,应该是权限设置<br /> SeImpersonateClient(device_extension->security_client_context, NULL);</p> <p> irp->IoStatus.Status = FileDiskOpenFile(device_object, irp);</p> <p> PsRevertToSelf();//nt未公开函数</p> <p> break;</p> <p> case IOCTL_FILE_DISK_CLOSE_FILE:<br /> irp->IoStatus.Status = FileDiskCloseFile(device_object, irp);<br /> break;</p> <p> default:<br /> irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;<br /> }<br /> break;</p> <p> default:<br /> irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;<br /> }</p> <p> IoCompleteRequest(<br /> irp,<br /> (CCHAR) (NT_SUCCESS(irp->IoStatus.Status) ?<br /> IO_DISK_INCREMENT : IO_NO_INCREMENT)<br /> );<br /> }<br /> }<br /> }<br />

     不得不看看WRITE和READ IRP是怎么处理的,代码如下;

NTSTATUS<br /> FileDiskReadWrite (//完成对虚拟磁盘的读写，对应于主功能代码IRP_MJ_WRITE和IRP_MJ_READ，<br /> //在进行读写之前要先确认设备是否存在。<br /> IN PDEVICE_OBJECT DeviceObject,<br /> IN PIRP Irp<br /> )<br /> {<br /> PDEVICE_EXTENSION device_extension;<br /> PIO_STACK_LOCATION io_stack;</p> <p> device_extension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;</p> <p> if (!device_extension->media_in_device)//虚拟盘内没介质则出错<br /> {<br /> Irp->IoStatus.Status = STATUS_NO_MEDIA_IN_DEVICE;<br /> Irp->IoStatus.Information = 0;</p> <p> IoCompleteRequest(Irp, IO_NO_INCREMENT);</p> <p> return STATUS_NO_MEDIA_IN_DEVICE;<br /> }</p> <p> io_stack = IoGetCurrentIrpStackLocation(Irp);</p> <p> if (io_stack->Parameters.Read.Length == 0)//如果要求读写长度为0,直接返回<br /> {<br /> Irp->IoStatus.Status = STATUS_SUCCESS;<br /> Irp->IoStatus.Information = 0;<br /> //标识IRP已经处理<br /> IoCompleteRequest(Irp, IO_NO_INCREMENT);<br /> //返回成功<br /> return STATUS_SUCCESS;<br /> }<br /> //通知客户端等IRP_MJ_READ/WRITE的响应<br /> IoMarkIrpPending(Irp);<br /> //插入到Irq处理队列链头</p> <p> ExInterlockedInsertTailList(<br /> &device_extension->list_head,<br /> &Irp->Tail.Overlay.ListEntry,<br /> &device_extension->list_lock<br /> );</p> <p> //触发线程事件<br /> KeSetEvent(<br /> &device_extension->request_event,<br /> (KPRIORITY) 0,<br /> FALSE<br /> );<br /> //返回等待处理响应<br /> return STATUS_PENDING;<br /> }

     从上面的代码可以方便的看出FileDisk驱动的IRP序列化的实现过程,方法很简单,将IRP包保存在List_head连表中,同时把与之相对应的自反锁保存在list_lock当中,在利用request_event事件通知驱动处理IRP.