Windows NT Driver >> Pascal
Cancel-Safe IRP Queue(CSQ)
參考資訊:
1. Source Code
2. cancel-safe-irp-queues
3. delphidriverdevelopmentkit
Cancel-Safe IRP Queues(CSQ)是Microsoft提供的一個Cancel框架,這個框架概念就是讓使用者只專注在Cancel的資料處理上,而不是Cancel的同步處理上,畢竟每個人做出來的Cancel同步機制可能不同,但是原理是一樣的,因此,Microsoft提供了一個專門框架給驅動程式使用並且建議使用這個框架處理Cancel Irp,下圖是說明的圖片:
對於CSQ細節有興趣的使用者可以參考上面的參考資訊,而設定的Callback如下所示:
1. CsqInsertIrp
2. CsqRemoveIrp
3. CsqPeekNextIrp
4. CsqAcquireLock
5. CsqReleaseLock
6. CsqCompleteCanceledIrp
main.pas
unit main; interface uses DDDK; const DEV_NAME = '\Device\MyDriver'; SYM_NAME = '\DosDevices\MyDriver'; IOCTL_QUEUE = $222000; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS) IOCTL_PROCESS = $222004; // CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall; implementation var dpc: TKDpc; obj: KTIMER; csq: IO_CSQ; lock: KSPIN_LOCK; queue: LIST_ENTRY; procedure CsqInsertIrp(pCsqInfo:PIO_CSQ; pIrp:PIRP); stdcall; begin DbgPrint('CsqInsertIrp', []); InsertTailList(@queue, @pIrp^.Tail.Overlay.s1.ListEntry); end; procedure CsqRemoveIrp(pCsqInfo:PIO_CSQ; pIrp:PIRP); stdcall; begin DbgPrint('CsqRemoveIrp', []); RemoveEntryList(@pIrp^.Tail.Overlay.s1.ListEntry); end; function CsqPeekNextIrp(Csq:PIO_CSQ; Irp:PIRP; PeekContext:Pointer):PIRP; stdcall; begin DbgPrint('CsqPeekNextIrp', []); Result:= Nil; end; procedure CsqAcquireLock(Csq:PIO_CSQ; Irql:PKIRQL); stdcall; begin DbgPrint('CsqAcquireLock', []); KiAcquireSpinLock(@lock); end; procedure CsqReleaseLock(Csq:PIO_CSQ; Irql:KIRQL); stdcall; begin if Irql = DISPATCH_LEVEL then begin KefReleaseSpinLockFromDpcLevel(@lock); DbgPrint('CsqReleaseLock at DPC level', []); end else begin KiReleaseSpinLock(@lock); DbgPrint('CsqReleaseLock at Passive level', []); end; end; procedure CsqCompleteCanceledIrp(Csq:PIO_CSQ; pIrp:PIRP); stdcall; begin DbgPrint('CsqCompleteCanceledIrp', []); pIrp^.IoStatus.Status:= STATUS_CANCELLED; pIrp^.IoStatus.Information:= 0; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; procedure OnTimer(Dpc:KDPC; DeferredContext:Pointer; SystemArgument1:Pointer; SystemArgument2:Pointer); stdcall; var irp: PIRP; plist: PLIST_ENTRY; begin if IsListEmpty(@queue) = True then begin KeCancelTimer(@obj); DbgPrint('Finish', []); end else begin plist:= RemoveHeadList(@queue); // CONTAINING_RECORD(IRP.Tail.Overlay.ListEntry) irp:= Pointer(Integer(plist) - 88); if irp^.Cancel = False then begin irp^.IoStatus.Status:= STATUS_SUCCESS; irp^.IoStatus.Information:= 0; IoCompleteRequest(irp, IO_NO_INCREMENT); DbgPrint('Complete Irp', []); end else begin irp^.CancelRoutine:= Nil; irp^.IoStatus.Status:= STATUS_CANCELLED; irp^.IoStatus.Information:= 0; IoCompleteRequest(irp, IO_NO_INCREMENT); DbgPrint('Cancel Irp', []); end; end; end; function IrpOpen(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; begin DbgPrint('IRP_MJ_CREATE', []); Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; function IrpClose(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; begin DbgPrint('IRP_MJ_CLOSE', []); Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; function IrpIOCTL(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall; var code: ULONG; tt: LARGE_INTEGER; psk: PIoStackLocation; begin psk:= IoGetCurrentIrpStackLocation(pIrp); code:= psk^.Parameters.DeviceIoControl.IoControlCode; case code of IOCTL_QUEUE:begin DbgPrint('IOCTL_QUEUE', []); IoCsqInsertIrp(@csq, pIrp, Nil); Result:= STATUS_PENDING; exit end; IOCTL_PROCESS:begin DbgPrint('IOCTL_PROCESS', []); tt.HighPart:= tt.HighPart or -1; tt.LowPart:= ULONG(-10000000); KeSetTimerEx(@obj, tt.LowPart, tt.HighPart, 1000, @dpc); end; end; Result:= STATUS_SUCCESS; pIrp^.IoStatus.Information:= 0; pIrp^.IoStatus.Status:= Result; IoCompleteRequest(pIrp, IO_NO_INCREMENT); end; procedure Unload(pOurDriver:PDriverObject); stdcall; var szSymName: TUnicodeString; begin RtlInitUnicodeString(@szSymName, SYM_NAME); IoDeleteSymbolicLink(@szSymName); IoDeleteDevice(pOurDriver^.DeviceObject); end; function _DriverEntry(pOurDriver:PDriverObject; pOurRegistry:PUnicodeString):NTSTATUS; stdcall; var suDevName: TUnicodeString; szSymName: TUnicodeString; pOurDevice: PDeviceObject; begin RtlInitUnicodeString(@suDevName, DEV_NAME); RtlInitUnicodeString(@szSymName, SYM_NAME); Result:= IoCreateDevice(pOurDriver, 0, @suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, pOurDevice); if NT_SUCCESS(Result) then begin pOurDriver^.MajorFunction[IRP_MJ_CREATE]:= @IrpOpen; pOurDriver^.MajorFunction[IRP_MJ_CLOSE] := @IrpClose; pOurDriver^.MajorFunction[IRP_MJ_DEVICE_CONTROL] := @IrpIOCTL; pOurDriver^.DriverUnload := @Unload; pOurDevice^.Flags:= pOurDevice^.Flags or DO_BUFFERED_IO; pOurDevice^.Flags:= pOurDevice^.Flags and not DO_DEVICE_INITIALIZING; InitializeListHead(@queue); KeInitializeSpinLock(@lock); KeInitializeTimer(@obj); KeInitializeDpc(@dpc, OnTimer, pOurDevice); IoCsqInitialize(@csq, CsqInsertIrp, CsqRemoveIrp, CsqPeekNextIrp, CsqAcquireLock, CsqReleaseLock, CsqCompleteCanceledIrp); Result:= IoCreateSymbolicLink(@szSymName, @suDevName); end; end; end.
DriverEntry()初始化List、DPC Timer和CSQ的Callback
IrpIOCTL()IOCTL_QUEUE把Irp加入List,IOCTL_PROCESS開始處理Irp
OnTimer()定時查看是否有需要處理的Irp
CsqReleaseLock()同步CSQ Irp用
CsqAcquireLock()同步CSQ Irp用
CsqPeekNextIrp()需要手動移除CSQ Irp時使用,目前沒有使用到
CsqCompleteCanceledIrp處理Cancel Irp用
CsqRemoveIrp()Irp被CSQ移除時呼叫
CsqInsertIrp()Irp被加入到CSQ時呼叫
app.pas
program main; {$APPTYPE CONSOLE} uses Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms, DIALOGS; const METHOD_BUFFERED = 0; METHOD_IN_DIRECT = 1; METHOD_OUT_DIRECT = 2; METHOD_NEITHER = 3; FILE_ANY_ACCESS = 0; FILE_DEVICE_UNKNOWN = $22; var fd: DWORD; ret: DWORD; cnt: DWORD; queue_code: DWORD; process_code: DWORD; ov: array [0..2] of OVERLAPPED; begin fd:= CreateFile('\\.\MyDriver', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, Nil, OPEN_EXISTING, FILE_FLAG_OVERLAPPED or FILE_ATTRIBUTE_NORMAL, 0); if (fd <> INVALID_HANDLE_VALUE) then begin queue_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($800 shl 2) or (METHOD_BUFFERED); process_code:= (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($801 shl 2) or (METHOD_BUFFERED); for cnt:= 0 to 2 do begin ov[cnt].hEvent:= CreateEvent(Nil, TRUE, FALSE, Nil); WriteLn(Output, 'queue event'); DeviceIoControl(fd, queue_code, Nil, 0, Nil, 0, ret, @ov[cnt]); end; WriteLn(Output, 'process all of events'); DeviceIoControl(fd, process_code, Nil, 0, Nil, 0, ret, Nil); Sleep(1000); CancelIo(fd); for cnt:= 0 to 2 do begin WaitForSingleObject(ov[cnt].hEvent, INFINITE); CloseHandle(ov[cnt].hEvent); WriteLn(Output, 'wait complete'); end; CloseHandle(fd); end else begin WriteLn(Output, 'failed to open mydriver'); end; end.
結果