自定义StartIO

StartIO主要保证  各个运行的IRP顺序执行，即串行化

用系统定义的StartIO例程只能使用一个队列，这个队列会将所有的IRP进行处理

  读写操作 都会混在一起进行串行处理，但我们需要将读写分别进行串行处理 ，就需要自定义StartIo

当自定义StartIO时，需要我们自己负责”入队“ + ”出队“

使用前初始化队列：

VOID 
  KeInitializeDeviceQueue(                           //在初始化设备的时候  初始化队列
    IN PKDEVICE_QUEUE  DeviceQueue
    );

typedef struct _KDEVICE_QUEUE {                                        //IRP队列来实现串行  
CSHORT Type;  
CSHORT Size;  
LIST_ENTRY devicelisthead;  
KSPIN_LOCK Lock;  
BOOLEAN Busy;  
} KDEVICE_QUEUE, *PKDEVICE_QUEUE, *RESTRICTED_POINTER PRKDEVICE_QUEUE;  

typedef struct _KDEVICE_QUEUE_ENTRY {   //队列中每个元素都用这个数据结构来表示
    LIST_ENTRY DeviceListEntry;
    ULONG SortKey;
    BOOLEAN Inserted;
} KDEVICE_QUEUE_ENTRY, *PKDEVICE_QUEUE_ENTRY, *PRKDEVICE_QUEUE_ENTRY;

BOOLEAN                                       //返回BOOL  如果当前设备不忙，则可以直接处理该IRP，因此这时候不需要插入队列，返回FALSE，调用我们的例程                                        如果设备正在处理，需要将IRP插入队列，这时候返回TRUE
  KeInsertDeviceQueue(                        //插入队列的函数
    IN PKDEVICE_QUEUE  DeviceQueue,           //被插入队列
    IN PKDEVICE_QUEUE_ENTRY  DeviceQueueEntry //插入原始
    );

PKDEVICE_QUEUE_ENTRY 
  KeRemoveDeviceQueue(
    IN PKDEVICE_QUEUE  DeviceQueue   //指定从哪个队列中取出元素
    );

VOID 
  KeRaiseIrql(             //提升权限
    IN KIRQL  NewIrql,     //这里可以设置 DISPATCH_LEVEL
    OUT PKIRQL  OldIrql    //这里是自定义的 KIRQL oldirql
    );

VOID 
  KeLowerIrql(
    IN KIRQL  NewIrql
    );

示例：

1）首先在设备扩展中加入 KEVICE_QUEUE 数据结构存储队列，并且在 DriverEntry中初始化该队列

如果我们需要对读写操作分别串行化，那么在设备扩展中创建两个队列，分别对读和写

2）编写派遣函数 首先用 IoMarkIrpPending 将IRP挂起，然后准备将IRP进行队列

3）在进入队列前，将当前的IRQL提升到  DISPATCH_LEVEL

4)插入队列，返回值指示是否需要立即执行，FALSE->IRP没有被插入到队列，而是需要被立刻结束，这时候 调用自定义的StartIO例程

00000000 0.00000000Enter DriverEntry
00000001 0.00007962Leave DriverEntry
00000002 3.99192595Enter HelloDDKDispatchRoutin
00000003 3.99193692IRP_MJ_CREATE
00000004 3.99239373Leave HelloDDKDispatchRoutin
00000005 3.99388027Enter HelloDDKRead
00000006 3.99389243HelloDDKRead irp :856658d8
00000007 3.99389529DeviceQueueEntry:85665918
00000008 3.99389815                                                                     不忙不需要插入例程  调用我们的例程
00000009 3.99390054Enter MyStartIo
00000010 3.99390268等3秒
00000011 3.99449444Enter HelloDDKRead                                   //////////////////////////////////////////////////////////////////////////////////////////////////////////
00000012 3.99449825HelloDDKRead irp :861fa510                      等待3秒时进行下一线程的进行
00000013 3.99450088DeviceQueueEntry:861fa550
00000014 3.99450326忙 插入例程到队列                                      这时候 当前设备正在操作线程1  忙  所以插入队列
00000015 3.99450636Leave HelloDDKRead                                  //////////////////////////////////////////////////////////////////////////////////////////////////////////
00000016 6.994039543秒结束
00000017 6.99406052Complete a irp:856658d8
00000018 6.99421740device_entry:861fa550
00000019 6.99421978循环一次                                                       //循环取队列  看是否空   不空就再来一次
00000020 6.99422169等3秒
00000021 9.994337083秒结束
00000022 9.99434948Complete a irp:861fa510
00000023 9.99453259device_entry:0
00000024 9.99453640device_entry 为空                                        //空 就结束 自定义StartIO例程
00000025 9.99453831Leave MyStartIo
00000026 9.99454212忙 插入例程到队列                                      //这里是因为没有例程了   所以返回失败  ················
00000027 9.99456406Leave HelloDDKRead
00000028 9.99637890Enter HelloDDKDispatchRoutin
00000029 9.99638176IRP_MJ_CLEANUP
00000030 9.99684811Leave HelloDDKDispatchRoutin
00000031 9.99746609Enter HelloDDKDispatchRoutin
00000032 9.99746990IRP_MJ_CLOSE
00000033 9.99793625Leave HelloDDKDispatchRoutin

驱动程序代码：

#include "Driver.h"

#pragma LOCKEDCODE                        //让函数运行在非分页内存中
VOID
  MyStartIo(
    IN PDEVICE_OBJECT  DeviceObject,
	IN PIRP pFistIrp
    )
{
	KdPrint(("Enter MyStartIo
"));

	PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
		DeviceObject->DeviceExtension;

	PKDEVICE_QUEUE_ENTRY device_entry;

	PIRP Irp = pFistIrp;
	do
	{
		KEVENT event;
		KeInitializeEvent(&event,NotificationEvent,FALSE);

		//等3秒
		KdPrint(("等3秒
"));
		LARGE_INTEGER timeout;
		timeout.QuadPart = -3*1000*1000*10;

		//定义一个3秒的延时，主要是为了模拟该IRP操作需要大概3秒左右时间
		KeWaitForSingleObject(&event,Executive,KernelMode,FALSE,&timeout);
		KdPrint(("3秒结束
"));
		KdPrint(("Complete a irp:%x
",Irp));
		Irp->IoStatus.Status = STATUS_SUCCESS;
		Irp->IoStatus.Information = 0;	// no bytes xfered
		IoCompleteRequest(Irp,IO_NO_INCREMENT);

		device_entry=KeRemoveDeviceQueue(&pDevExt->device_queue);
		KdPrint(("device_entry:%x
",device_entry));
		if (device_entry==NULL)
		{
			KdPrint(("device_entry 为空
"));
			break;
		}

		Irp = CONTAINING_RECORD(device_entry, IRP, Tail.Overlay.DeviceQueueEntry);
		KdPrint(("循环一次
"));                  //循环取队列 看是否为空  不为空   就是后面还有例程
	}while(1);

	KdPrint(("Leave MyStartIo
"));
}
/************************************************************************
* 函数名称:DriverEntry
* 功能描述:初始化驱动程序，定位和申请硬件资源，创建内核对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
      pRegistryPath:驱动程序在注册表的中的路径
* 返回 值:返回初始化驱动状态
*************************************************************************/
#pragma INITCODE
extern "C" NTSTATUS DriverEntry (
			IN PDRIVER_OBJECT pDriverObject,
			IN PUNICODE_STRING pRegistryPath	) 
{
	NTSTATUS status;
	KdPrint(("Enter DriverEntry
"));

	//设置卸载函数
	pDriverObject->DriverUnload = HelloDDKUnload;

	//设置派遣函数
	pDriverObject->MajorFunction[IRP_MJ_CREATE] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_CLOSE] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_WRITE] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_READ] = HelloDDKRead;
	pDriverObject->MajorFunction[IRP_MJ_CLEANUP] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = HelloDDKDispatchRoutin;
	pDriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = HelloDDKDispatchRoutin;

	//创建驱动设备对象
	status = CreateDevice(pDriverObject);

	KdPrint(("Leave DriverEntry
"));
	return status;
}
/************************************************************************
* 函数名称:CreateDevice
* 功能描述:初始化设备对象
* 参数列表:
      pDriverObject:从I/O管理器中传进来的驱动对象
* 返回 值:返回初始化状态
*************************************************************************/
#pragma INITCODE
NTSTATUS CreateDevice (
		IN PDRIVER_OBJECT	pDriverObject) 
{
	NTSTATUS status;
	PDEVICE_OBJECT pDevObj;
	PDEVICE_EXTENSION pDevExt;
	
	//创建设备名称
	UNICODE_STRING devName;
	RtlInitUnicodeString(&devName,L"\Device\MyDDKDevice");
	
	//创建设备
	status = IoCreateDevice( pDriverObject,
						sizeof(DEVICE_EXTENSION),
						&(UNICODE_STRING)devName,
						FILE_DEVICE_UNKNOWN,
						0, TRUE,
						&pDevObj );
	if (!NT_SUCCESS(status))
		return status;

	pDevObj->Flags |= DO_BUFFERED_IO;
	pDevExt = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
	pDevExt->pDevice = pDevObj;
	pDevExt->ustrDeviceName = devName;

	RtlZeroBytes(&pDevExt->device_queue,sizeof(pDevExt->device_queue));
	KeInitializeDeviceQueue(&pDevExt->device_queue);

	//创建符号链接
	UNICODE_STRING symLinkName;
	RtlInitUnicodeString(&symLinkName,L"\??\HelloDDK");
	pDevExt->ustrSymLinkName = symLinkName;
	status = IoCreateSymbolicLink( &symLinkName,&devName );
	if (!NT_SUCCESS(status)) 
	{
		IoDeleteDevice( pDevObj );
		return status;
	}
	return STATUS_SUCCESS;
}
/************************************************************************
* 函数名称:HelloDDKUnload
* 功能描述:负责驱动程序的卸载操作
* 参数列表:
      pDriverObject:驱动对象
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
VOID HelloDDKUnload (IN PDRIVER_OBJECT pDriverObject) 
{
	PDEVICE_OBJECT	pNextObj;
	KdPrint(("Enter DriverUnload
"));
	pNextObj = pDriverObject->DeviceObject;
	while (pNextObj != NULL) 
	{
		PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
			pNextObj->DeviceExtension;

		//删除符号链接
		UNICODE_STRING pLinkName = pDevExt->ustrSymLinkName;
		IoDeleteSymbolicLink(&pLinkName);

		pNextObj = pNextObj->NextDevice;
		IoDeleteDevice( pDevExt->pDevice );
	}
}
/************************************************************************
* 函数名称:HelloDDKDispatchRoutin
* 功能描述:对读IRP进行处理
* 参数列表:
      pDevObj:功能设备对象
      pIrp:从IO请求包
* 返回 值:返回状态
*************************************************************************/
#pragma PAGEDCODE
NTSTATUS HelloDDKDispatchRoutin(IN PDEVICE_OBJECT pDevObj,
								 IN PIRP pIrp) 
{
	KdPrint(("Enter HelloDDKDispatchRoutin
"));

	PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
	//建立一个字符串数组与IRP类型对应起来
	static char* irpname[] = 
	{
		"IRP_MJ_CREATE",
		"IRP_MJ_CREATE_NAMED_PIPE",
		"IRP_MJ_CLOSE",
		"IRP_MJ_READ",
		"IRP_MJ_WRITE",
		"IRP_MJ_QUERY_INFORMATION",
		"IRP_MJ_SET_INFORMATION",
		"IRP_MJ_QUERY_EA",
		"IRP_MJ_SET_EA",
		"IRP_MJ_FLUSH_BUFFERS",
		"IRP_MJ_QUERY_VOLUME_INFORMATION",
		"IRP_MJ_SET_VOLUME_INFORMATION",
		"IRP_MJ_DIRECTORY_CONTROL",
		"IRP_MJ_FILE_SYSTEM_CONTROL",
		"IRP_MJ_DEVICE_CONTROL",
		"IRP_MJ_INTERNAL_DEVICE_CONTROL",
		"IRP_MJ_SHUTDOWN",
		"IRP_MJ_LOCK_CONTROL",
		"IRP_MJ_CLEANUP",
		"IRP_MJ_CREATE_MAILSLOT",
		"IRP_MJ_QUERY_SECURITY",
		"IRP_MJ_SET_SECURITY",
		"IRP_MJ_POWER",
		"IRP_MJ_SYSTEM_CONTROL",
		"IRP_MJ_DEVICE_CHANGE",
		"IRP_MJ_QUERY_QUOTA",
		"IRP_MJ_SET_QUOTA",
		"IRP_MJ_PNP",
	};

	UCHAR type = stack->MajorFunction;
	if (type >= arraysize(irpname))
		KdPrint((" - Unknown IRP, major type %X
", type));
	else
		KdPrint(("	%s
", irpname[type]));

	//对一般IRP的简单操作，后面会介绍对IRP更复杂的操作
	NTSTATUS status = STATUS_SUCCESS;
	// 完成IRP
	pIrp->IoStatus.Status = status;
	pIrp->IoStatus.Information = 0;	// bytes xfered
	IoCompleteRequest( pIrp, IO_NO_INCREMENT );

	KdPrint(("Leave HelloDDKDispatchRoutin
"));

	return status;
}

VOID
OnCancelIRP(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )
{
	KdPrint(("Enter CancelReadIRP
"));

	//释放Cancel自旋锁
	IoReleaseCancelSpinLock(Irp->CancelIrql);
	
	//设置完成状态为STATUS_CANCELLED
 	Irp->IoStatus.Status = STATUS_CANCELLED;
 	Irp->IoStatus.Information = 0;	// bytes xfered
 	IoCompleteRequest( Irp, IO_NO_INCREMENT );

	KdPrint(("Leave CancelReadIRP
"));
}

NTSTATUS HelloDDKRead(IN PDEVICE_OBJECT pDevObj,
								 IN PIRP pIrp) 
{
	KdPrint(("Enter HelloDDKRead
"));

	PDEVICE_EXTENSION pDevExt = (PDEVICE_EXTENSION)
			pDevObj->DeviceExtension;

	//将IRP设置为挂起
	IoMarkIrpPending(pIrp);

	IoSetCancelRoutine(pIrp,OnCancelIRP);             //设置取消IRP的例程  这里没有被调用到
	
	KIRQL oldirql;
	//提升IRP至DISPATCH_LEVEL
	KeRaiseIrql(DISPATCH_LEVEL, &oldirql);

	KdPrint(("HelloDDKRead irp :%x
",pIrp));

	KdPrint(("DeviceQueueEntry:%x
",&pIrp->Tail.Overlay.DeviceQueueEntry));
	if (!KeInsertDeviceQueue(&pDevExt->device_queue, &pIrp->Tail.Overlay.DeviceQueueEntry))
	{
		KdPrint(("不忙 不需要插入例程  调用我们的例程
"));
		MyStartIo(pDevObj,pIrp);
	}
	KdPrint(("忙 插入例程到队列
"));
	//将IRP降至原来IRQL
	KeLowerIrql(oldirql);

	KdPrint(("Leave HelloDDKRead
"));

	//返回pending状态
	return STATUS_PENDING;
}

应用程序代码：

#include <windows.h>
#include <stdio.h>
#include <process.h>

UINT WINAPI Thread(LPVOID context)
{
	printf("Enter Thread
");
	OVERLAPPED overlap={0};
	overlap.hEvent = CreateEvent(NULL,FALSE,FALSE,NULL);
	UCHAR buffer[10];
	ULONG ulRead;
	
	BOOL bRead = ReadFile(*(PHANDLE)context,buffer,10,&ulRead,&overlap);

	WaitForSingleObject(overlap.hEvent,INFINITE);
	printf("Leave Thread
");
	return 0;
}

int main()
{
	HANDLE hDevice = 
		CreateFile("\\.\HelloDDK",
					GENERIC_READ | GENERIC_WRITE,
					FILE_SHARE_READ,
					NULL,
					OPEN_EXISTING,
					FILE_ATTRIBUTE_NORMAL|FILE_FLAG_OVERLAPPED,//此处设置FILE_FLAG_OVERLAPPED
					NULL );

	if (hDevice == INVALID_HANDLE_VALUE)
	{
		printf("Open Device failed!");
		return 1;
	}

	HANDLE hThread[2];
	hThread[0] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);
	hThread[1] = (HANDLE) _beginthreadex (NULL,0,Thread,&hDevice,0,NULL);

	//主线程等待两个子线程结束
	WaitForMultipleObjects(2,hThread,TRUE,INFINITE);
	
	printf("Two Thread over!
");
	//创建IRP_MJ_CLEANUP IRP
	CloseHandle(hDevice);

	return 0;
}