理解和使用NT驱动程序的执行上下文（一）

来源：互联网发布：网络授课平台兼职编辑：程序博客网时间：2024/06/06 15:48

NT-SIZE: 14.5pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: Arial; mso-hansi-foNT-family: Arial; mso-bidi-foNT-family: Arial; mso-foNT-kerning: 0pt">理解和使用NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">NTNT-SIZE: 14.5pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: Arial; mso-hansi-foNT-family: Arial; mso-bidi-foNT-family: Arial; mso-foNT-kerning: 0pt">驱动程序的执行上下文（一）NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">翻译：李华谊NT-SIZE: 10pt; mso-foNT-kerning: 0pt"> horily@163.com

NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">理解NT-SIZE: 10pt; mso-foNT-kerning: 0pt">Windows NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">驱动程序最重要的概念之一就是驱动程序运行时所处的“执行上下文”。理解并小心地应用这个概念可以帮助你构建更快、更高效的驱动程序。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">标准内核模式驱动程序编程中的一个重要观念是某个特定的驱动程序函数执行时所处的“上下文”。传统上文件系统开发者最关注这个问题，但所有类型的NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">内核模式驱动程序的编写者都能从对执行上下文的深刻理解中获益。小心谨慎地使用执行上下文的概念能帮助构建更高性能、更低开销的驱动程序设计。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">在本文中，我们将探寻执行上下文的概念。作为对概念的示范，本文在结尾描述了一个能让用户程序在内核模式下运行并拥有其中所有权限的驱动程序。在这个过程中，我们也将讨论设备驱动程序中执行上下文的实际用法。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 11.5pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">什么是上下文？NT-SIZE: 11.5pt; mso-foNT-kerning: 0pt">

NT-SIZE: 14.5pt; FONT-FAMILY: Arial; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">当提及一个例程的上下文时，我们是指它的线程和进程的执行环境。在NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">中，这个环境由当前的线程环境块（NT-SIZE: 10pt; mso-foNT-kerning: 0pt">TEBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">）和进程环境块（NT-SIZE: 10pt; mso-foNT-kerning: 0pt">PEBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">）建立。上下文因此包括虚拟内存的设置（告诉我们那个物理内存页面对应那个虚拟内存地址），句柄转换（因为句柄是基于进程的），分派器信息，堆栈，以及通用和浮点寄存器的设置。当我们问到一个特定的内核例程运行在那个上下文时，我们实际在问，“那一个是（NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">内核）分派器建立的当前线程？”因为每一个线程只属于一个进程，当前线程确定了当前进程。当前线程和当前进程在一起确定了唯一标识线程和进程的所有事情（句柄、虚拟内存、调度器状态和寄存器）。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">虚拟内存也许是上下文中对内核模式驱动程序编写者最有用的一个方面。还记得NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">把用户进程映射到虚拟地址空间的低NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">，把操作系统自身的代码映射到虚拟地址空间的高NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">吗？当一个用户进程中的线程执行时，它的虚拟地址范围是NT-SIZE: 10pt; mso-foNT-kerning: 0pt">0NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">到NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">，NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">以上的所有地址均被设置为“NT-SIZE: 10pt; mso-foNT-kerning: 0pt">no accessNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">”，以此防止用户直接访问操作系统代码和结构。当操作系统代码执行时，它的虚拟地址范围是NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">到NT-SIZE: 10pt; mso-foNT-kerning: 0pt">4GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">，而当前用户进程（如果有的话）的地址映射到NT-SIZE: 10pt; mso-foNT-kerning: 0pt">0NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">到NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">。在NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NT3.51NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">和NT-SIZE: 10pt; mso-foNT-kerning: 0pt">V4.0NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">中，映射到高NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">地址的代码从不变化。然而，映射到低NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">地址的代码会变化，取决于当前进程是那一个。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">此外，在NT-SIZE: 10pt; mso-foNT-kerning: 0pt">NTNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">特殊的虚拟内存排布策略中，进程NT-SIZE: 10pt; mso-foNT-kerning: 0pt">PNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">内一个合法的虚拟地址NT-SIZE: 10pt; mso-foNT-kerning: 0pt">XNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">（NT-SIZE: 10pt; mso-foNT-kerning: 0pt">XNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">小于等于NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">）和内核虚拟地址NT-SIZE: 10pt; mso-foNT-kerning: 0pt">XNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">对应于相同的物理内存位置。当然，这只有在进程NT-SIZE: 10pt; mso-foNT-kerning: 0pt">PNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">是当前进程并且（也因此）进程NT-SIZE: 10pt; mso-foNT-kerning: 0pt">PNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">的物理页面映射到操作系统的低NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">虚拟地址空间时才能成立。上面这句话的另一个说法就是，“这只在NT-SIZE: 10pt; mso-foNT-kerning: 0pt">PNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">是当前进程时才能成立。”所以在同一个进程上下文中，用户虚拟地址和NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">以上的内核虚拟地址指向相同的物理位置。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">上下文中另一个让内核模式驱动程序编写者感兴趣的方面是线程调度上下文。当一个线程在等待时（例如通过发出NT-SIZE: 10pt; mso-foNT-kerning: 0pt">Win32NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">函数NT-SIZE: 10pt; mso-foNT-kerning: 0pt">WaitForSingleObject(…)NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">来等待一个没有被激发的对象），这个线程的调度上下文对象被用来存储关于线程定义所等待的对象的信息。当发出未满足的等待时，这个线程就从就绪队列中被移出，只有当等待被满足（指定的分派器对象被激发）时才被移回。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">上下文也影响到句柄的使用。因为句柄是针对一个特定的进程的，在一个进程中创建的句柄在其他进程上下文中是没有用的。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 11.5pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">不同类型的上下文NT-SIZE: 11.5pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">内核模式的例程运行在下面三种不同的上下文之一：NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">－NT-SIZE: 10pt; mso-foNT-kerning: 0pt"> NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">系统进程上下文NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">－NT-SIZE: 10pt; mso-foNT-kerning: 0pt"> NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">特定用户线程（和进程）上下文NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">－NT-SIZE: 10pt; mso-foNT-kerning: 0pt"> NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">任意用户线程（和进程）上下文NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; mso-foNT-kerning: 0pt">

NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">在执行过程中，每一个内核模式驱动程序的各部分可能运行在上面三种上下文之一。例如，一个驱动程序的NT-SIZE: 10pt; mso-foNT-kerning: 0pt">DriverENTry(…)NT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">函数总是运行在系统进程的上下文中。系统进程上下文无用户上下文无关（因此没有NT-SIZE: 10pt; mso-foNT-kerning: 0pt">TEBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">），并且也没有用户进程映射到内核虚拟地址空间的低NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">中。另一方面，NT-SIZE: 10pt; mso-foNT-kerning: 0pt">DPCsNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">（例如一个驱动程序为NT-SIZE: 10pt; mso-foNT-kerning: 0pt">ISRNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">服务的NT-SIZE: 10pt; mso-foNT-kerning: 0pt">DPCNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">或者定时器到期函数）运行在任意用户线程的上下文中。这意味者在一个NT-SIZE: 10pt; mso-foNT-kerning: 0pt">DPCNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">的执行过程中，任何用户线程都可以成为“当前”线程，因此任何用户进程都可以映射到内核虚拟地址空间的低NT-SIZE: 10pt; mso-foNT-kerning: 0pt">2GBNT-SIZE: 10pt; FONT-FAMILY: 宋体; mso-ascii-foNT-family: 'Times New Roman'; mso-hansi-foNT-family: 'Times New Roman'; mso-foNT-kerning: 0pt">中。NT-SIZE: 10pt; mso-foNT-kerning: 0pt">