自定义StartIO

StartIO主要保证  各个运行的IRP顺序执行，即串行化

用系统定义的StartIO例程只能使用一个队列，这个队列会将所有的IRP进行处理

  读写操作 都会混在一起进行串行处理，但我们需要将读写分别进行串行处理 ，就需要自定义StartIo

当自定义StartIO时，需要我们自己负责”入队“ + ”出队“

使用前初始化队列：

VOID   KeInitializeDeviceQueue(                           //在初始化设备的时候  初始化队列    IN PKDEVICE_QUEUE  DeviceQueue    );

typedef struct _KDEVICE_QUEUE {                                        //IRP队列来实现串行  CSHORT Type;  CSHORT Size;  LIST_ENTRY devicelisthead;  KSPIN_LOCK Lock;  BOOLEAN Busy;  } KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;  

typedef struct _KDEVICE_QUEUE_ENTRY {   //队列中每个元素都用这个数据结构来表示    LIST_ENTRY DeviceListEntry;    ULONG SortKey;    BOOLEAN Inserted;} KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY, *PRKDEVICE_QUEUE_ENTRY;

BOOLEAN                                       //返回BOOL  如果当前设备不忙，则可以直接处理该IRP，因此这时候不需要插入队列，返回FALSE，调用我们的例程                                        如果设备正在处理，需要将IRP插入队列，这时候返回TRUE  KeInsertDeviceQueue(                        //插入队列的函数    IN PKDEVICE_QUEUE  DeviceQueue,           //被插入队列    IN PKDEVICE_QUEUE_ENTRY  DeviceQueueEntry //插入原始    );

PKDEVICE_QUEUE_ENTRY   KeRemoveDeviceQueue(    IN PKDEVICE_QUEUE  DeviceQueue   //指定从哪个队列中取出元素    );

VOID   KeRaiseIrql(             //提升权限    IN KIRQL  NewIrql,     //这里可以设置 DISPATCH_LEVEL    OUT PKIRQL  OldIrql    //这里是自定义的 KIRQL oldirql    );

VOID   KeLowerIrql(    IN KIRQL  NewIrql    );

示例：

1）首先在设备扩展中加入 KEVICE_QUEUE 数据结构存储队列，并且在 DriverEntry中初始化该队列

如果我们需要对读写操作分别串行化，那么在设备扩展中创建两个队列，分别对读和写

2）编写派遣函数 首先用 IoMarkIrpPending 将IRP挂起，然后准备将IRP进行队列

3）在进入队列前，将当前的IRQL提升到  DISPATCH_LEVEL

4)插入队列，返回值指示是否需要立即执行，FALSE->IRP没有被插入到队列，而是需要被立刻结束，这时候 调用自定义的StartIO例程

00000000 0.00000000Enter DriverEntry
00000001 0.00007962Leave DriverEntry
00000002 3.99192595Enter HelloDDKDispatchRoutin
00000003 3.99193692IRP_MJ_CREATE
00000004 3.99239373Leave HelloDDKDispatchRoutin
00000005 3.99388027Enter HelloDDKRead
00000006 3.99389243HelloDDKRead irp :856658d8
00000007 3.99389529DeviceQueueEntry:85665918
00000008 3.99389815                                                                     不忙不需要插入例程  调用我们的例程
00000009 3.99390054Enter MyStartIo
00000010 3.99390268等3秒
00000011 3.99449444Enter HelloDDKRead                                   //////////////////////////////////////////////////////////////////////////////////////////////////////////
00000012 3.99449825HelloDDKRead irp :861fa510                     等待3秒时进行下一线程的进行
00000013 3.99450088DeviceQueueEntry:861fa550
00000014 3.99450326忙 插入例程到队列                                      这时候 当前设备正在操作线程1  忙  所以插入队列
00000015 3.99450636Leave HelloDDKRead                                  //////////////////////////////////////////////////////////////////////////////////////////////////////////
00000016 6.994039543秒结束
00000017 6.99406052Complete a irp:856658d8
00000018 6.99421740device_entry:861fa550
00000019 6.99421978循环一次                                                       //循环取队列  看是否空   不空就再来一次
00000020 6.99422169等3秒
00000021 9.994337083秒结束
00000022 9.99434948Complete a irp:861fa510
00000023 9.99453259device_entry:0
00000024 9.99453640device_entry 为空                                        //空 就结束 自定义StartIO例程
00000025 9.99453831Leave MyStartIo
00000026 9.99454212忙 插入例程到队列                                      //这里是因为没有例程了   所以返回失败  ················
00000027 9.99456406Leave HelloDDKRead
00000028 9.99637890Enter HelloDDKDispatchRoutin
00000029 9.99638176IRP_MJ_CLEANUP
00000030 9.99684811Leave HelloDDKDispatchRoutin
00000031 9.99746609Enter HelloDDKDispatchRoutin
00000032 9.99746990IRP_MJ_CLOSE
00000033 9.99793625Leave HelloDDKDispatchRoutin

驱动程序代码：

#include "Driver.h"#pragma LOCKEDCODE                        //让函数运行在非分页内存中VOID  MyStartIo(    IN PDEVICE_OBJECT  DeviceObject,IN PIRP pFistIrp    ){KdPrint(("Enter MyStartIo\n"));PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension;PKDEVICE_QUEUE_ENTRY device_entry;PIRP Irp = pFistIrp;do{KEVENT event;KeInitializeEvent(&event,NotificationEvent,FALSE);//等3秒KdPrint(("等3秒\n"));LARGE_INTEGER timeout;timeout.QuadPart = -3*1000*1000*10;//定义一个3秒的延时，主要是为了模拟该IRP操作需要大概3秒左右时间KeWaitForSingleObject(&event,Executive,KernelMode,FALSE,&timeout);KdPrint(("3秒结束\n"));KdPrint(("Complete a irp:%x\n",Irp));Irp->IoStatus.Status = STATUS_SUCCESS;Irp->IoStatus.Information = 0;// no bytes xferedIoCompleteRequest(Irp,IO_NO_INCREMENT);device_entry=KeRemoveDeviceQueue(&pDevExt->device_queue);KdPrint(("device_entry:%x\n",device_entry));if (device_entry==NULL){KdPrint(("device_entry 为空\n"));break;}Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);KdPrint(("循环一次\n"));                  //循环取队列 看是否为空  不为空   就是后面还有例程}while(1);KdPrint(("Leave MyStartIo\n"));}/************************************************************************* 函数名称:DriverEntry* 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象* 参数列表:      pDriverObject:从I/O管理器中传进来的驱动对象      pRegistryPath:驱动程序在注册表的中的路径* 返回 值:返回初始化驱动状态*************************************************************************/#pragma INITCODEextern "C" NTSTATUS DriverEntry (IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING pRegistryPath) {NTSTATUS status;KdPrint(("Enter DriverEntry\n"));//设置卸载函数pDriverObject->DriverUnload = HelloDDKUnload;//设置派遣函数pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKRead;pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = HelloDDKDispatchRoutin;pDriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = HelloDDKDispatchRoutin;//创建驱动设备对象status = CreateDevice(pDriverObject);KdPrint(("Leave DriverEntry\n"));return status;}/************************************************************************* 函数名称:CreateDevice* 功能描述:初始化设备对象* 参数列表:      pDriverObject:从I/O管理器中传进来的驱动对象* 返回 值:返回初始化状态*************************************************************************/#pragma INITCODENTSTATUS CreateDevice (IN PDRIVER_OBJECTpDriverObject) {NTSTATUS status;PDEVICE_OBJECT pDevObj;PDEVICE_EXTENSION pDevExt;//创建设备名称UNICODE_STRING devName;RtlInitUnicodeString(&devName,L"\\Device\\MyDDKDevice");//创建设备status = IoCreateDevice( pDriverObject,sizeof(DEVICE_EXTENSION),&(UNICODE_STRING)devName,FILE_DEVICE_UNKNOWN,0, TRUE,&pDevObj );if (!NT_SUCCESS(status))return status;pDevObj->Flags |= DO_BUFFERED_IO;pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;pDevExt->pDevice = pDevObj;pDevExt->ustrDeviceName = devName;RtlZeroBytes(&pDevExt->device_queue,sizeof(pDevExt->device_queue));KeInitializeDeviceQueue(&pDevExt->device_queue);//创建符号链接UNICODE_STRING symLinkName;RtlInitUnicodeString(&symLinkName,L"\\??\\HelloDDK");pDevExt->ustrSymLinkName = symLinkName;status = IoCreateSymbolicLink( &symLinkName,&devName );if (!NT_SUCCESS(status)) {IoDeleteDevice( pDevObj );return status;}return STATUS_SUCCESS;}/************************************************************************* 函数名称:HelloDDKUnload* 功能描述:负责驱动程序的卸载操作* 参数列表:      pDriverObject:驱动对象* 返回 值:返回状态*************************************************************************/#pragma PAGEDCODEVOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject) {PDEVICE_OBJECTpNextObj;KdPrint(("Enter DriverUnload\n"));pNextObj = pDriverObject->DeviceObject;while (pNextObj != NULL) {PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pNextObj->DeviceExtension;//删除符号链接UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;IoDeleteSymbolicLink(&pLinkName);pNextObj = pNextObj->NextDevice;IoDeleteDevice( pDevExt->pDevice );}}/************************************************************************* 函数名称:HelloDDKDispatchRoutin* 功能描述:对读IRP进行处理* 参数列表:      pDevObj:功能设备对象      pIrp:从IO请求包* 返回 值:返回状态*************************************************************************/#pragma PAGEDCODENTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp) {KdPrint(("Enter HelloDDKDispatchRoutin\n"));PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);//建立一个字符串数组与IRP类型对应起来static char* irpname[] = {"IRP_MJ_CREATE","IRP_MJ_CREATE_NAMED_PIPE","IRP_MJ_CLOSE","IRP_MJ_READ","IRP_MJ_WRITE","IRP_MJ_QUERY_INFORMATION","IRP_MJ_SET_INFORMATION","IRP_MJ_QUERY_EA","IRP_MJ_SET_EA","IRP_MJ_FLUSH_BUFFERS","IRP_MJ_QUERY_VOLUME_INFORMATION","IRP_MJ_SET_VOLUME_INFORMATION","IRP_MJ_DIRECTORY_CONTROL","IRP_MJ_FILE_SYSTEM_CONTROL","IRP_MJ_DEVICE_CONTROL","IRP_MJ_INTERNAL_DEVICE_CONTROL","IRP_MJ_SHUTDOWN","IRP_MJ_LOCK_CONTROL","IRP_MJ_CLEANUP","IRP_MJ_CREATE_MAILSLOT","IRP_MJ_QUERY_SECURITY","IRP_MJ_SET_SECURITY","IRP_MJ_POWER","IRP_MJ_SYSTEM_CONTROL","IRP_MJ_DEVICE_CHANGE","IRP_MJ_QUERY_QUOTA","IRP_MJ_SET_QUOTA","IRP_MJ_PNP",};UCHAR type = stack->MajorFunction;if (type >= arraysize(irpname))KdPrint((" - Unknown IRP, major type %X\n", type));elseKdPrint(("\t%s\n", irpname[type]));//对一般IRP的简单操作，后面会介绍对IRP更复杂的操作NTSTATUS status = STATUS_SUCCESS;// 完成IRPpIrp->IoStatus.Status = status;pIrp->IoStatus.Information = 0;// bytes xferedIoCompleteRequest( pIrp, IO_NO_INCREMENT );KdPrint(("Leave HelloDDKDispatchRoutin\n"));return status;}VOIDOnCancelIRP(    IN PDEVICE_OBJECT DeviceObject,    IN PIRP Irp    ){KdPrint(("Enter CancelReadIRP\n"));//释放Cancel自旋锁IoReleaseCancelSpinLock(Irp->CancelIrql);//设置完成状态为STATUS_CANCELLED Irp->IoStatus.Status = STATUS_CANCELLED; Irp->IoStatus.Information = 0;// bytes xfered IoCompleteRequest( Irp, IO_NO_INCREMENT );KdPrint(("Leave CancelReadIRP\n"));}NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp) {KdPrint(("Enter HelloDDKRead\n"));PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;//将IRP设置为挂起IoMarkIrpPending(pIrp);IoSetCancelRoutine(pIrp,OnCancelIRP);             //设置取消IRP的例程  这里没有被调用到KIRQL oldirql;//提升IRP至DISPATCH_LEVELKeRaiseIrql(DISPATCH_LEVEL, &oldirql);KdPrint(("HelloDDKRead irp :%x\n",pIrp));KdPrint(("DeviceQueueEntry:%x\n",&pIrp->Tail.Overlay.DeviceQueueEntry));if (!KeInsertDeviceQueue(&pDevExt->device_queue, &pIrp->Tail.Overlay.DeviceQueueEntry)){KdPrint(("不忙 不需要插入例程  调用我们的例程\n"));MyStartIo(pDevObj,pIrp);}KdPrint(("忙 插入例程到队列\n"));//将IRP降至原来IRQLKeLowerIrql(oldirql);KdPrint(("Leave HelloDDKRead\n"));//返回pending状态return STATUS_PENDING;}

应用程序代码：

#include <windows.h>#include <stdio.h>#include <process.h>UINT WINAPI Thread(LPVOID context){printf("Enter Thread\n");OVERLAPPED overlap={0};overlap.hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);UCHAR buffer[10];ULONG ulRead;BOOL bRead = ReadFile(*(PHANDLE)context,buffer,10,&ulRead,&overlap);WaitForSingleObject(overlap.hEvent,INFINITE);printf("Leave Thread\n");return 0;}int main(){HANDLE hDevice = CreateFile("\\\\.\\HelloDDK",GENERIC_READ | GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OVERLAPPED,//此处设置FILE_FLAG_OVERLAPPEDNULL );if (hDevice == INVALID_HANDLE_VALUE){printf("Open Device failed!");return 1;}HANDLE hThread[2];hThread[0] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);hThread[1] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);//主线程等待两个子线程结束WaitForMultipleObjects(2,hThread,TRUE,INFINITE);printf("Two Thread over!\n");//创建IRP_MJ_CLEANUP IRPCloseHandle(hDevice);return 0;}