Windows NT Driver >> Pascal
Cancel IRP
參考資訊:
1. Source Code
2. canceling-irps
3. delphidriverdevelopmentkit
有處理Irp就會有Cancel Irp的時候,Cancel Irp本身就是一個很複雜的課題,司徒在這一篇教學不會做深入探討,有興趣的使用者可以參考上面的參考資訊,取而代之的,司徒只是點出,在處理Irp時,使用者要意識到該Irp可能已經被Cancel掉了,作法上,也是可以切割成很多時期,如:Irp處理前,Irp處裡中,Irp處裡後,因此,在設計驅動程式時,對於Cancel機制有必要嚴謹看待,因為,BSOD常常就是這樣發生了,不過司徒在此僅針對Irp處裡前,作簡單判斷,是否User Application已經Cancel這個Irp,如果沒有被Cancel,則Complete Irp,相反地,如果被Cancel,則Cancel Irp,Cancel作法如下:
1. CancelRoutine(NULL)
2. IoCompleteRequest(STATUS_CANCELLED)
main.pas
unit main; interface uses DDDK; const DEV_NAME = '\Device\MyDriver'; SYM_NAME = '\DosDevices\MyDriver'; IOCTL_QUEUE = $222000; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) IOCTL_PROCESS = $222004; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall; implementation var dpc: TKDpc; obj: KTIMER; queue: LIST_ENTRY; procedure OnTimer(Dpc:KDPC; DeferredContext:Pointer; SystemArgument1:Pointer; SystemArgument2:Pointer); stdcall; var irp: PIRP; plist: PLIST_ENTRY; begin if IsListEmpty(@queue) = True then begin KeCancelTimer(@obj); DbgPrint('Finish', []); end else begin plist:= RemoveHeadList(@queue); // CONTAINING_RECORD(IRP.Tail.Overlay.ListEntry) irp:= Pointer(Integer(plist) - 88); if irp^.Cancel = False then begin irp^.IoStatus.Status:= STATUS_SUCCESS; irp^.IoStatus.Information:= 0; IoCompleteRequest(irp, IO_NO_INCREMENT); DbgPrint('Complete Irp', []); end else begin irp^.CancelRoutine:= Nil; irp^.IoStatus.Status:= STATUS_CANCELLED; irp^.IoStatus.Information:= 0; IoCompleteRequest(irp, IO_NO_INCREMENT); DbgPrint('Cancel Irp', []); end; end; end; function IrpOpen(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; begin DbgPrint('IRP_MJ_CREATE', []); Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; function IrpClose(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; begin DbgPrint('IRP_MJ_CLOSE', []); Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; function IrpIOCTL(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; var code: ULONG; tt: LARGE_INTEGER; psk: PIoStackLocation; begin psk:= IoGetCurrentIrpStackLocation(pIrp); code:= psk^.Parameters.DeviceIoControl.IoControlCode; case code of IOCTL_QUEUE:begin DbgPrint('IOCTL_QUEUE', []); InsertHeadList(@queue, @pIrp^.Tail.Overlay.s1.ListEntry); IoMarkIrpPending(pIrp); Result:= STATUS_PENDING; exit end; IOCTL_PROCESS:begin DbgPrint('IOCTL_PROCESS', []); tt.HighPart:= tt.HighPart or -1; tt.LowPart:= ULONG(-10000000); KeSetTimerEx(@obj, tt.LowPart, tt.HighPart, 1000, @dpc); end; end; Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; procedure Unload(pOurDriver:PDriverObject); stdcall; var szSymName: TUnicodeString; begin RtlInitUnicodeString(@szSymName, SYM_NAME); IoDeleteSymbolicLink(@szSymName); IoDeleteDevice(pOurDriver^.DeviceObject); end; function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall; var suDevName: TUnicodeString; szSymName: TUnicodeString; pOurDevice: PDeviceObject; begin RtlInitUnicodeString(@suDevName, DEV_NAME); RtlInitUnicodeString(@szSymName, SYM_NAME); Result:= IoCreateDevice(pOurDriver, 0, @suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, pOurDevice); if NT_SUCCESS(Result) then begin pOurDriver^.MajorFunction[IRP_MJ_CREATE]:= @IrpOpen; pOurDriver^.MajorFunction[IRP_MJ_CLOSE] := @IrpClose; pOurDriver^.MajorFunction[IRP_MJ_DEVICE_CONTROL] := @IrpIOCTL; pOurDriver^.DriverUnload := @Unload; pOurDevice^.Flags:= pOurDevice^.Flags or DO_BUFFERED_IO; pOurDevice^.Flags:= pOurDevice^.Flags and not DO_DEVICE_INITIALIZING; InitializeListHead(@queue); KeInitializeTimer(@obj); KeInitializeDpc(@dpc, OnTimer, pOurDevice); Result:= IoCreateSymbolicLink(@szSymName, @suDevName); end; end; end.
DriverEntry()初始List以及DPC Timer,DPC Timer用來定期確認List是否還有資料需要處理,當然,使用Thread檢查或許更恰當些
IrpIOCTL()IOCTL_QUEUE代表該IOCTL會被Queue起來,稍後處理,而當收到IOCTL_PROCESS時,則啟動DPC Timer開始處理那些被Queue起來的Irp
OnTimer()處理Queue裡面的Irp,在處理前,先判斷該Irp是否已經被Cancel了
app.pas
program main; {$APPTYPE CONSOLE} uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, DIALOGS; const METHOD_BUFFERED = 0; METHOD_IN_DIRECT = 1; METHOD_OUT_DIRECT = 2; METHOD_NEITHER = 3; FILE_ANY_ACCESS = 0; FILE_DEVICE_UNKNOWN = $22; var fd: DWORD; ret: DWORD; cnt: DWORD; queue_code: DWORD; process_code: DWORD; ov: array [0..2] of OVERLAPPED; begin fd:= CreateFile('\\.\MyDriver', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, Nil, OPEN_EXISTING, FILE_FLAG_OVERLAPPED or FILE_ATTRIBUTE_NORMAL, 0); if (fd <> INVALID_HANDLE_VALUE) then begin queue_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($800 shl 2) or (METHOD_BUFFERED); process_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($801 shl 2) or (METHOD_BUFFERED); for cnt:= 0 to 2 do begin ov[cnt].hEvent:= CreateEvent(Nil, TRUE, FALSE, Nil); WriteLn(Output, 'queue event'); DeviceIoControl(fd, queue_code, Nil, 0, Nil, 0, ret, @ov[cnt]); end; WriteLn(Output, 'process all of events'); DeviceIoControl(fd, process_code, Nil, 0, Nil, 0, ret, Nil); Sleep(1000); CancelIo(fd); for cnt:= 0 to 2 do begin WaitForSingleObject(ov[cnt].hEvent, INFINITE); CloseHandle(ov[cnt].hEvent); WriteLn(Output, 'wait complete'); end; CloseHandle(fd); end else begin WriteLn(Output, 'failed to open mydriver'); end; end.
結果