刚看完FileDisk代码,感受颇多,其中采用线程的方式进行IRP序列化更是让人觉得新鲜.在DDK中一般采用StartIo来进行IRP的序列话,其中在入口函数中加入pDriverObject->DriverStartUp = XXXStartIO即可, 当然也没这么简单,其中还要做写处理.
FileDisk采用了另外一种方法,先来看看代码;
//为IRP消息而设的双向循环链表结构
InitializeListHead(&device_extension->list_head);
//自旋锁初始化,锁住双向链表,在线程处理中解锁
KeInitializeSpinLock(&device_extension->list_lock);
//设置同步事件
KeInitializeEvent(
&device_extension->request_event,
SynchronizationEvent,//同步事件操作,在每一次wait通过后自动将事件设为未受信状态,
//使下一次wait阻塞.NotificationEvent则不会自动设置,需要手动
FALSE//初始状态为未受信状态
);
//设置线程有效
device_extension->terminate_thread = FALSE;
//建立主线程,实际上一个盘只有一个线程操作
status = PsCreateSystemThread(
&thread_handle,//获得线程句柄
(ACCESS_MASK) 0L,//屏蔽消息
NULL,
NULL,
NULL,
FileDiskThread,//触发磁盘操作线程
device_object
);
这里可以看出,将FileDisk将IRP包保存在List_head当中,方便于在FileDiskThread线程直接进行处理.接下来看看FileDiskThread线程代码如何实现;
VOID
FileDiskThread (
IN PVOID Context
)
{
PDEVICE_OBJECT device_object;
PDEVICE_EXTENSION device_extension;
PLIST_ENTRY request;//双向链表的IRP栈
PIRP irp;
PIO_STACK_LOCATION io_stack;
PUCHAR system_buffer;
PUCHAR buffer;
ASSERT(Context != NULL);//?
device_object = (PDEVICE_OBJECT) Context;
device_extension = (PDEVICE_EXTENSION) device_object->DeviceExtension;
//设置优先级
KeSetPriorityThread(KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
for (;;)//以下为线程的无限循环,当device_extension->terminate_thread设为true时才结束.
{
//等待request_event事件置信,for每循环一次,在这里被阻塞,等待
KeWaitForSingleObject(
&device_extension->request_event,
Executive,
KernelMode,
FALSE,
NULL
);
//如果结束线程标志置位,结束线程
if (device_extension->terminate_thread)
{
PsTerminateSystemThread(STATUS_SUCCESS);
}
//遍历IRP表
while (request = ExInterlockedRemoveHeadList(
&device_extension->list_head,
&device_extension->list_lock
)) //list不为空,则指向下一链表数据
{
irp = CONTAINING_RECORD(request, IRP, Tail.Overlay.ListEntry); //获取irp基地址,tail是IRP结构里面的一个Union结构,Tail.Overlay.ListEntry说明IRP入栈待处理
////IRP的栈返回形式
io_stack = IoGetCurrentIrpStackLocation(irp);
switch (io_stack->MajorFunction)
{
case IRP_MJ_READ://读数据到内存
system_buffer = (PUCHAR) MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority);//分配MDL虚拟地址空间
if (system_buffer == NULL)
{
irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;//分配失败返回资源不足警告
irp->IoStatus.Information = 0;
break;
}
buffer = (PUCHAR) ExAllocatePool(PagedPool, io_stack->Parameters.Read.Length); //分配空间
if (buffer == NULL)
{
irp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
irp->IoStatus.Information = 0;
break;
}
ZwReadFile(
device_extension->file_handle, //读取指定的映像文件
NULL,
NULL,
NULL,
&irp->IoStatus,
buffer, //文件缓冲
io_stack->Parameters.Read.Length,
&io_stack->Parameters.Read.ByteOffset,
NULL
);
RtlCopyMemory(system_buffer, buffer, io_stack->Parameters.Read.Length); //将文件缓冲读入到MDL缓冲
ExFreePool(buffer);//释放文件缓冲
break;
case IRP_MJ_WRITE://内存数据写到设备
if ((io_stack->Parameters.Write.ByteOffset.QuadPart +
io_stack->Parameters.Write.Length) >
device_extension->file_size.QuadPart)//判错处理
{
irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
irp->IoStatus.Information = 0;
}
ZwWriteFile(
device_extension->file_handle,
NULL,
NULL,
NULL,
&irp->IoStatus,
MmGetSystemAddressForMdlSafe(irp->MdlAddress, NormalPagePriority), //从MDL缓冲写入文件
io_stack->Parameters.Write.Length,
&io_stack->Parameters.Write.ByteOffset,
NULL
); //写文件
break;
//下面的是自定义IRP响应
case IRP_MJ_DEVICE_CONTROL:
switch (io_stack->Parameters.DeviceIoControl.IoControlCode)
{
case IOCTL_FILE_DISK_OPEN_FILE:
//nt未公开函数,应该是权限设置
SeImpersonateClient(device_extension->security_client_context, NULL);
irp->IoStatus.Status = FileDiskOpenFile(device_object, irp);
PsRevertToSelf();//nt未公开函数
break;
case IOCTL_FILE_DISK_CLOSE_FILE:
irp->IoStatus.Status = FileDiskCloseFile(device_object, irp);
break;
default:
irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;
}
break;
default:
irp->IoStatus.Status = STATUS_DRIVER_INTERNAL_ERROR;
}
IoCompleteRequest(
irp,
(CCHAR) (NT_SUCCESS(irp->IoStatus.Status) ?
IO_DISK_INCREMENT : IO_NO_INCREMENT)
);
}
}
}
不得不看看WRITE和READ IRP是怎么处理的,代码如下;
NTSTATUS
FileDiskReadWrite (//完成对虚拟磁盘的读写，对应于主功能代码IRP_MJ_WRITE和IRP_MJ_READ，
//在进行读写之前要先确认设备是否存在。
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
{
PDEVICE_EXTENSION device_extension;
PIO_STACK_LOCATION io_stack;
device_extension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;
if (!device_extension->media_in_device)//虚拟盘内没介质则出错
{
Irp->IoStatus.Status = STATUS_NO_MEDIA_IN_DEVICE;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_NO_MEDIA_IN_DEVICE;
}
io_stack = IoGetCurrentIrpStackLocation(Irp);
if (io_stack->Parameters.Read.Length == 0)//如果要求读写长度为0,直接返回
{
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
//标识IRP已经处理
IoCompleteRequest(Irp, IO_NO_INCREMENT);
//返回成功
return STATUS_SUCCESS;
}
//通知客户端等IRP_MJ_READ/WRITE的响应
IoMarkIrpPending(Irp);
//插入到Irq处理队列链头
ExInterlockedInsertTailList(
&device_extension->list_head,
&Irp->Tail.Overlay.ListEntry,
&device_extension->list_lock
);
//触发线程事件
KeSetEvent(
&device_extension->request_event,
(KPRIORITY) 0,
FALSE
);
//返回等待处理响应
return STATUS_PENDING;
}
从上面的代码可以方便的看出FileDisk驱动的IRP序列化的实现过程,方法很简单,将IRP包保存在List_head连表中,同时把与之相对应的自反锁保存在list_lock当中,在利用request_event事件通知驱动处理IRP.