司徒的教學網站

Windows Driver Model >> Pascal >> IOCTL

METHOD_IN_DIRECT、METHOD_OUT_DIRECT

參考資訊：
1. Source Code
2. delphidriverdevelopmentkit

METHOD_IN_DIRECT、METHOD_OUT_DIRECT的概念就是直接Mapping User Buffer，然後驅動程式使用該Mapped的MDL(Memory Description List)操作，相較於METHOD_BUFFERED，因為不須I/O Manager更新回User Buffer>，因此，效率會比較好，而相比File的DO_DIRECT_IO，IOCTL細分成IN和OUT兩種，這是因為IOCTL有區分Input和Output Buffer的緣故，因此，會有方向性的考量，Microsoft針對這部份的描述，僅說明MDL描述會有讀>寫存取方向的區分，但是司徒實際測試，發現DeviceIoControl()的Input和Output Buffer是可以混用的，意思就是Input Buffer可以充當Input或Output Buffer使用，而Output Buffer也可以充當Input或Output Buffer使用，只要驅動程式跟User Application定義好即可，當然，METHOD_IN_DIRECT和METHOD_OUT_DIRECT也是可以混用的，關於這部份的細節，有興趣的使用者可以研讀WRK代碼，不過，深怕未知問題可能發生，建議還是依照Microsoft規定去撰寫驅動程式會比較保險。

Microsoft針對I/O部份的說明：
buffer-descriptions-for-i-o-control-codes

記憶體指標：

	Buffer	Length
Input	(Irp) AssociatedIrp.SystemBuffer	(IrpStack) Parameters.DeviceIoControl.InputBufferLength
Output	(MDL) MmGetSystemAddressForMdlSafe	(IrpStack) Parameters.DeviceIoControl.OutputBufferLength

main.pas

unit main;

interface
  uses
    DDDK;
    
  const
    DEV_NAME = '\Device\MyDriver';
    SYM_NAME = '\DosDevices\MyDriver';
    IOCTL_SET = (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($800 shl 2) or (METHOD_IN_DIRECT);
    IOCTL_GET = (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($801 shl 2) or (METHOD_OUT_DIRECT);

  function _DriverEntry(pOurDriver:PDRIVER_OBJECT; pOurRegistry:PUNICODE_STRING):NTSTATUS; stdcall;

implementation
var
  pNextDevice: PDEVICE_OBJECT;
  szBuf: array[0..255] of char;
  
procedure Unload(pOurDriver:PDRIVER_OBJECT); stdcall;
begin
end;

function IrpFile(pOurDevice:PDEVICE_OBJECT; pIrp:PIRP):NTSTATUS; stdcall;
var
  psk: PIO_STACK_LOCATION;
  
begin
  psk:= IoGetCurrentIrpStackLocation(pIrp);
  case psk^.MajorFunction of
  IRP_MJ_CREATE:
    DbgPrint('IRP_MJ_CREATE', []);
  IRP_MJ_CLOSE:
    DbgPrint('IRP_MJ_CLOSE', []);
  end;
  
  Result:= STATUS_SUCCESS;
  pIrp^.IoStatus.Status:= Result;
  pIrp^.IoStatus.Information:= 0;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
end;

function IrpIOCTL(pOurDevice:PDeviceObject; pIrp:PIrp):NTSTATUS; stdcall;
var
  len: ULONG;
  dst: PChar;
  code: ULONG;
  psk: PIO_STACK_LOCATION;
 
begin
  len:= 0;
  psk:= IoGetCurrentIrpStackLocation(pIrp);
  code:= psk^.Parameters.DeviceIoControl.IoControlCode;
  case code of
  IOCTL_GET:begin
    DbgPrint('IOCTL_GET', []);
    len:= strlen(@szBuf[0])+1;
    dst:= MmGetSystemAddressForMdlSafe(pIrp^.MdlAddress, LowPagePriority);
    memcpy(dst, @szBuf[0], len);
  end;
  IOCTL_SET:begin
    DbgPrint('IOCTL_SET', []);
    len:= psk^.Parameters.DeviceIoControl.InputBufferLength;
    memcpy(@szBuf[0], pIrp^.AssociatedIrp.SystemBuffer, len);
    DbgPrint('Buffer: %s, Length: %d', [szBuf, len]);
  end;
  end;
   
  Result:= STATUS_SUCCESS;
  pIrp^.IoStatus.Information:= len;
  pIrp^.IoStatus.Status:= Result;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
end;

function IrpPnp(pOurDevice:PDEVICE_OBJECT; pIrp:PIRP):NTSTATUS; stdcall;
var
  psk: PIO_STACK_LOCATION;
  suSymName: UNICODE_STRING;
  
begin
  psk:= IoGetCurrentIrpStackLocation(pIrp);
  if psk^.MinorFunction = IRP_MN_REMOVE_DEVICE then
  begin
    RtlInitUnicodeString(@suSymName, SYM_NAME);
    IoDetachDevice(pNextDevice);
    IoDeleteDevice(pOurDevice);
    IoDeleteSymbolicLink(@suSymName);
  end;
  IoSkipCurrentIrpStackLocation(pIrp);
  Result:= IoCallDriver(pNextDevice, pIrp);
end;

function AddDevice(pOurDriver:PDRIVER_OBJECT; pPhyDevice:PDEVICE_OBJECT):NTSTATUS; stdcall;
var
  suDevName: UNICODE_STRING;
  suSymName: UNICODE_STRING;
  pOurDevice: PDEVICE_OBJECT;
  
begin
  RtlInitUnicodeString(@suDevName, DEV_NAME);
  RtlInitUnicodeString(@suSymName, SYM_NAME);
  IoCreateDevice(pOurDriver, 0, @suDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, pOurDevice);
  pNextDevice:= IoAttachDeviceToDeviceStack(pOurDevice, pPhyDevice);
  pOurDevice^.Flags:= pOurDevice^.Flags or DO_BUFFERED_IO;
  pOurDevice^.Flags:= pOurDevice^.Flags and not DO_DEVICE_INITIALIZING;
  Result:= IoCreateSymbolicLink(@suSymName, @suDevName);
end;

function _DriverEntry(pOurDriver:PDRIVER_OBJECT; pOurRegistry:PUNICODE_STRING):NTSTATUS; stdcall;
begin
  pOurDriver^.MajorFunction[IRP_MJ_PNP]:= @IrpPnp;
  pOurDriver^.MajorFunction[IRP_MJ_CREATE]:= @IrpFile;
  pOurDriver^.MajorFunction[IRP_MJ_CLOSE]:= @IrpFile;
  pOurDriver^.MajorFunction[IRP_MJ_DEVICE_CONTROL] := @IrpIOCTL;
  pOurDriver^.DriverExtension^.AddDevice:=@AddDevice;
  pOurDriver^.DriverUnload:=@Unload;
  Result:=STATUS_SUCCESS;
end;
end.

IrpIOCTL()收到IOCTL_SET時，Driver複製User Buffer的內容到szBuffer，而收到IOCTL_GET時，將szBuffer內容又複製回User Buffer，完成暫存的功能，IoStatus.Information的數值就是OutBufferSize回傳的長度。

app.pas

program main;

{$APPTYPE CONSOLE}

uses
  Windows,
  Messages,
  SysUtils,
  Variants,
  Classes,
  Graphics,
  Controls,
  Forms,
  DIALOGS;

const
  METHOD_BUFFERED = 0;
  METHOD_IN_DIRECT = 1;
  METHOD_OUT_DIRECT = 2;
  FILE_ANY_ACCESS = 0;
  FILE_DEVICE_UNKNOWN = $22;
  IOCTL_SET = (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($800 shl 2) or (METHOD_IN_DIRECT);
  IOCTL_GET = (FILE_DEVICE_UNKNOWN shl 16) or (FILE_ANY_ACCESS shl 14) or ($801 shl 2) or (METHOD_OUT_DIRECT);

var
  fd: DWORD;
  ret: DWORD;
  len: DWORD;
  buf: array[0..255] of char;

begin
  fd:= CreateFile('\\.\MyDriver', GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ, Nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  if (fd <> INVALID_HANDLE_VALUE) then
  begin
    StrCopy(buf, 'I am error');
    len:= strlen(buf)+1;
    
    DeviceIoControl(fd, IOCTL_SET, @buf, len, Nil, 0, ret, Nil);
    WriteLn(Output, Format('SET: %s, %d', [buf, len]));

    FillChar(buf, sizeof(buf), #0);
    DeviceIoControl(fd, IOCTL_GET, Nil, 0, @buf, len, ret, Nil);
    WriteLn(Output, Format('GET: %s, %d', [buf, ret]));
    
    CloseHandle(fd);
  end else
  begin
    WriteLn(Output, 'failed to open mydriver');
  end;
end.

結果

返回上一頁