Ch 7. Driver Dispatch Routines

1
Ch 7. Driver Dispatch Routines
2
Goals

• ????? ???? ???? ??
• ???? ?? ???

• Kernel Mode Object Type ??
• Driver? ??? Context?? ? Store Place ??
• DriverEntry, Unload Routine? ??(6?)
• IRP_MJ_CREATE, IRP_MJ_CLOSE dispatch Routine(7?)
• CreateFile , CloseHandle
• Hardware ??? ??? ???? Code ??
• Unload? ??? ??? ???? Code ??
• IRP_MJ_XXX ??? ???? dispatch Routine ??
• Win32 App?? ReadFile, WriteFile ??? Test ??
• ???? Routine ??
• Start I/O Routine
• Interrupt Service Routine
• DPC Routine
• DeviceIOControl Code ??
• Win32 App? ?? Hardware Register? ???? ??

3
Contents

• Driver Dispatch Routines
• Writing Driver Dispatch Routines
• Processing Read and Write Requests
• Code Example Loop-back Device
• Extending the Dispatch interface
• Testing Driver Dispatch Routine
• Summary

4
Driver Dispatch Routines
5
???? ????? I/O ?? ????(1)
IO_STACK_LOCATION, PIO_STACK_LOCATION IO_STACK_LOCATION, PIO_STACK_LOCATION
Filed Contents
UCHAR MajorFunction IRP_MJXXX?? ???? ??.
UCHAR MinorFunction File System?? SCSI????? ??? ??????.
Union Paramenters MajorFunction Code? ?? Union??
struct Write IRP_MJ_WRITE? ?? ???? ULONG Length ULONG Key LARGE_INTEGER ByteOffset
struct DeviceIOControl IRP_MJ_DEVICE_CONTROL ?? ???? ULONG OutputBufferLength ULONG InputBufferLength ULONG IoControlCode PVOID Ttpe3InputBuffer
struct Others PVOID Argument1-Argument4
PDEVICE_OBJECT DeviceObject I/O Request? ?? ???? ??
PFILE_OBJECT FileOnject ??? ??? File Object 
struct Read IRP_MJ_READ? ?? ???? ULONG Length ULONG Key LARGE_INTEGER ByteOffset
ltIRP? ??gt
ltDriverObject ??gt
ltIRP ??? ???? IRP ?? ???? ??gt
6
???? ????? I/O ?? ????(2)
IRP

IRP_MJ_WRITE

MajorFunction
???? ??

DispatchCreate
_IopInvalidDeviceRequest
DispatchRead
DispatchWite
_IopInvalidDeviceRequest
IRP_MJ_CREATE
MajorFunction
. . .
IRP_MJ_READ
IRP_MJ_WRITE
. . .
?? ???? ??
? _IopInvalidDeviceRequest? ???? ?? I/O ??? ???
??? ???? ??? I/O????? ??
7
?? ?? ??? ???
NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDO, IN
PUNICODE_STRING pRegPath) pDO-gtMajorFunctio
n IRP_MJ_CREATE DispCreate pDO-gtMajorFuncti
on IRP_MJ_CLOSE DispClose pDO-gtMajorFunctio
n IRP_MJ_CLEANUP DispCleanup pDO-gtMajorFunc
tion IRP_MJ_READ DispRead pDO-gtMajorFunctio
n IRP_MJ_WRITE DispWrite return
STATUS_SUCCESS

• IRP_MJ_XXX(NTDDK.h, WDM.h)
• DriverEntry? ???? ?? _IopInvalidDeviceRequest
  ???? ????.

8
?? ?? ??? ??? ? ????
IRP MajorFunction ?? IRP MajorFunction ??
?? ?? ??
IRP_MJ_CREATE ??? ????. CreateFile
IRP_MJ_CLEANUP ??? ?? ? ??? IRP? ?????. CloseHandle
IRP_MJ_CLOSE ??? ???. CloseHandle
IRP_MJ_READ ??????? ???? ???. ReadFile
IRP_MJ_WRITE ????? ???? ??? WriteFile
IRP_MJ_DEVICE_CONTROL Control ??? ????. DeviceIOControl
IRP_MJ_INTERNAL_DEVICE_CONTROL ?? ?? ?????? ???? Control ??? ????(Win32 ????? ??? ? ??.
IRP_MJ_FLUSH_BUFFERS ??? ??? ??? ???. FlushFileBuffers FlushConsoleInputBuffer PurgeComm
IRP_MJ_SHUTDOWN ???? ???? ? InitiateSystemShutdown
9
Writing Driver Dispatch Routines
10
?? ????

• ???? ??? ??? ??? ???.
• PASSIVE_LEVEL IRQL

NTSTATUS ???? IRQL PASSIVE_LEVEL
?? ??
IN PDEVICE_OBJECT pDevObject ??? ?? ?? ????? ???
IN PIRP pIrp ??? ???? IRP? ???
?? ? STATUS_SUCCESS ?? ?? STATUS_PENDING ?? ?? STATUS_XXX ??? ?? ??
lt???? ??? ?? ??gt

• Buffered I/O ? Direct I/O ??
• IRP? IRP??? ???? ??? ?? ??
• ?? ??? ?? IRP? ?? ??

11
???? ???? ???? ??

• IoGetCurrentIrpStackLocation
• IRP? ?? ??? ??
• ?? ????? ??
• ????? _IopInvalidDeviceRequest? ???? ????

12
???? ???? ?????(1)

• ?? ??
• ?? ??
• ???? ??? ????

13
???? ???? ?????(2)

• ??? ??

NTSTATUS DispatchWrite(IN PDEVICE_OBJECT pDO, IN
PIRP pIrp) // ?? ?? ??? ? ?????? ???? ??
???? // ??? ???? ??? ????. pIrp-gtIoStatus.Status
STATUS_NOT_INCREMENT_SUPPORTED // ??? ????
??? ????. pIrp-gtIoStatus.Information
0 //????? ?? ?? IRP? ?????. IoCompleteRequest(p
Irp, IO_NO_INCREMENT) return STATUS_NOT_SUPPORTE
D
14
???? ???? ?????(3)

• ??? ??

NTSTATUS DispatchClose(IN PDEVICE_OBJECT pDO, IN
PIRP pIrp) pIrp-gtIoStatus.Status
STATUS_SUCCESS // ??? ???? 0?????
????. pIrp-gtIoStatus.Information 0 // IRP?
??? ????. ? ??? ??? ???? ???. IoCompleteRequest
(pIrp, IO_NO_INCREMENT) return STATUS_SUCCESS
15
???? ???? ?????(4)

• ???? ??? ????

NTSTATUS DispatchWrite(IN PDEVICE_OBJECT pDO, IN
PIRP pIrp) // IRP? ????? ????. IoMarkIrpPen
ding(pIrp) // ????? Start I/O ??? ?? ??? ???
// IRP? ??(????)??. // ? ?? ????? ?? I/O ???
?? ?? ????? ??. // ? ?? ????? Cancel ??? ??
????. IoStartPacket(pDO, pIrp, 0, NULL) return
STATUS_PENDING
16
Processing Read and Write Requests
17
??? ???? ??

• ???? ??? Flags ??(DO_BUFFERED_IO, DO_DIRECT_IO)
• BUFFERED I/O
• - Non-paged ?(pool) ??? ??
• - IRP? AssociatedIrp.SystemBuffer ??? ??
• DIRECT I/O
• - ??? ??? ???? ?? ??? ???? ???(lock)
• - MDL(Memory Descriptor List)
• - IRP? MdlAddress ??? ??
• NEITHER Method
• - Flags?? ??? ?? ??? ??
• - I/O ???? ?? ?? ??? ???? ???.

18
Code Example

• loop-back routine

19
Code Example ??? ????(1)
Write ??? ?? ???? ??(1)
NTSTATUS DispatchWrite ( IN PDEVICE_OBJECT
pDevObj, IN PIRP pIrp ) NTSTATUS status
STATUS_SUCCESS PVOID userBuffer ULONG
xferSize // ?? ????? ??? ??? ??? ??
??. PIO_STACK_LOCATION pIrpStack
IoGetCurrentIrpStackLocation( pIrp ) // ?? ???
???? ???? ?? ?? ??? DEVICE_EXTENSION ??
????. PDEVICE_EXTENSION pDevExt
(PDEVICE_EXTENSION)pDevObj-gtDeviceExtension //
??? ?? ???? ??? ????. if (pDevExt-gtdeviceBuffer
! NULL) ExFreePool(pDevExt-gtdeviceBuffer)
pDevExt-gtdeviceBuffer NULL pDevExt-gtdeviceBuf
ferSize 0 xferSize pIrpStack-gtParameters
.Write.Length // ? ????? ????? Buffered I/O?
???? ??? ?? userBuffer pIrp-gtAssociatedIrp.Syst
emBuffer
20
Code Example ??? ????(2)
Write ??? ?? ???? ??(2)
pDevExt-gtdeviceBuffer ExAllocatePool(
PagedPool, xferSize ) if (pDevExt-gtdeviceBuffer
NULL) // ?? ??? ?? status
STATUS_INSUFFICIENT_RESOURCES xferSize 0
else // ??? ?? pDevExt-gtdeviceBufferSize
xferSize RtlCopyMemory( pDevExt-gtdeviceBuffer,
userBuffer, xferSize ) // ???? ??? ???? ??
IRP? ????. pIrp-gtIoStatus.Status
status pIrp-gtIoStatus.Information
xferSize // bytes xfered IoCompleteRequest(
pIrp, IO_NO_INCREMENT ) return status
21
Code Example ??? ????(3)
Read ??? ?? ???? ??(1)
NTSTATUS DispatchRead (IN PDEVICE_OBJECT pDevObj,
IN PIRP pIrp) NTSTATUS status
STATUS_SUCCESS PVOID userBuffer ULONG
xferSize // ?? ????? ??? ??? ??? ???
??. PIO_STACK_LOCATION pIrpStack
IoGetCurrentIrpStackLocation( pIrp ) // ??
??? ???? ???? ?? ?? ??? DEVICE_EXTENSION ??
?? PDEVICE_EXTENSION pDevExt
(PDEVICE_EXTENSION)pDevObj-gtDeviceExtension xfer
Size pIrpStack-gtParameters.Read.Length userBuf
fer pIrp-gtAssociatedIrp.SystemBuffer //
???? ??? ?? ? ?? ??? ???? ???. xferSize
(xferSize lt pDevExt-gtdeviceBufferSize)
? xferSize pDevExt-gtdeviceBufferSize
22
Code Example ??? ????(4)
Read ??? ?? ???? ??(1)
// ?? ??? ??? ???? ????. RtlCopyMemory(
userBuffer, pDevExt-gtdeviceBuffer, xferSize
) // ?? paged ? ??? ????. ExFreePool(
pDevExt-gtdeviceBuffer ) pDevExt-gtdeviceBuffer
NULL pDevExt-gtdeviceBufferSize 0 // ???
I/O ??? ????. pIrp-gtIoStatus.Status
status pIrp-gtIoStatus.Information
xferSize IoCompleteRequest( pIrp,
IO_NO_INCREMENT ) return status
23
Code Example ??? ????(5)
24
Extending the Dispatch Interface
25
???? ?????? ??

• read/write ?? ??? ?? ??
• (? ??? ??, ???)
• IRP_MJ_DEVICE_CONTROL
• - IoControl(IOCTL ???? ??? ?)
• IRP_MJ_INTERNAL_DEVICE_CONTROL
• - ?? ????? ??
• - IRP_MJ_DEVICE_CONTROL? ??

26
???? IOCTL ?? ?? ??(1)
0
31
31-16 15-14 13-2 1-0
???? ??
??? ??
??? ??
?? ??
ltIOCTL ?? ???? ????gt
27
???? IOCTL ?? ?? ??(2)
CTL_CODE ??? CTL_CODE ???
?? ??
DeviceType IoCreateDevice? ???? FILE_DEVICE_XXX? ? 0x00000x7fff Microsoft? ?? ??? ? 0x80000xffff ??? ?? ?
ControlCode ?????? ??? IOCTL ?? 0x000x7ff Microsoft? ?? ??? ? 0x80000xfff ??? ?? ?
TransferType ?? ??? ??? ?? ?? ?? ???? METHOD_BUFFERED METHOD_IN_DIRECT METHOD_OUT_DIRECT METHOD_NEITHER
RequiredAccess ???? ?? ?? FILE_ANY_ACCESS FILE_READ_DATA FILE_WRITE_DATA FILE_READ_DATA FILE_WRITE_DATA
ltCTL_CODE ??? ??gt
28
IOCTL ?? ?? ??

• CTL_CODE? TransferType(2bit)
• METHOD_BUFFERED
• METHOD_IN_DIRECT
• METHOD_OUT_DIRECT
• METHOD_NEITHER

29
IOCTL ?? ?? ????
define IOCTL_MISSLEDEVICE_AIM CTL_CODE( FILE_DE
VICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_A
CCESS_ANY) // IOCTL_MISSLEDEVICE_AIM ?? ???
??? Typedef struct _AIM_IN_BUFFER ULONG
Longitude ULONG Latitude AIM_IN_BUFFER,
PAIM_IN_BUFFER Typedef struct _AIM_OUT_BUFFER
ULONG ExtendedStatus AIM_OUT_BUFFER,
PAIM_OUT_BUFFER define IOCTL_MISSLEDEVICE_LAUN
CH CTL_CODE( \ FILE_DEVICE_UNKNOWN, \ 0x802,
\ METHOD_NEITHER, \ FILE_ACCESS_ANY)
30
IOCTL ??? ??(1)

• I/O ???? ?? ????? ??

NTSTATUS DispatchIoControl(IN PDEVICE_OBJECT pDO,
IN PIRP pIrp) NTSTATUS status
STATUS_SUCCESS PDEVICE_EXTENSION pDE PVOID
userBuffer ULONG inSize ULONG outSize ULONG
controlCode // IOCTL ?? ?? // ?? ????? ??? ???
??? ?? ??. PIO_STACK_LOCATION pIrpStack pIrpSta
ck IoGetCurrentIrpStackLocation(pIrp) //
IOCTL ??? ????. controlCode pIrpStack-gtParamete
rs.DeviceIoControl.IoControlCode // ??? ??? ??
??? ????. inSize pIrpStack-gtParameters.DeviceIo
Control.InputBufferLength outSize
pIrpStack-gtParameters.DeviceIoControl.OutputBuffer
Length
31
IOCTL ??? ??(2)
// // ? ?? Switch ?? ????. switch (controlCode)
case IOCTL_MISSLEDEVICEAIM // ? case?? ??
????? ???? ????. if(inSize lt sizeof(AIM_IN_BUFFER
) outSize lt sizeof(AIM_OUT_BUFFER)) stat
us STATUS_INVALID_BUFFER_SIZE break //
??? IRP??? ????? ????. IoMarkIrpPending(pIrp) I
oStartPacket(pDO, pIrp, 0, NULL) return
STATUS_PENDING case IOCTL_DEVICE_LAUNCH
if(inSize gt 0 outSize gt0) // ?? ??? ???.
??? ????? ?? ??? //??? ?? ?? ????? ???
??. status STATUS_INVALID_PARAMETER brea
k // ????? ???? ?? ??? ??? ???. //
return STATUS_PENDING default // ??????
??? ? ?? ??? ???. status STATUS_INVALID_DEVICE_
REQUEST break
32
IOCTL ??? ??(3)
// ??? ??? ??? ??? ?? ???? ????. // ? ????? ???
??? ???? ????. // IRP ??? ?? ????.
pIrp-gtIoStatus.Status status pIrp-gtIoStatus.In
formation 0 //??? ???? ??? ????. IoCompleteRe
quest(pIrp, IO_NO_INCREMENT) return status
33
IOCTL ?? ??

• ???? ?? ?? ????
• ??? ??? 2?? ??
• METHOD_BUFFERED
• METHOD_IN_DIRECT
• METHOD_OUT_DIRECT
• METHOD_NEITHER

34
Testing Driver Dispatch Routines
35
??? ??

• ????? ??? ??? ?? ?? ? ???
• ?? ???? ??? ???? ??? ????,
• Win32 I/O ??? ??? ?????
• ??? I/O??? ?? ????? ???

36
?? ??? ????
include ltwindows.hgt include ltstdio.hgt Void
main() HANDLE hDevice BOOL status hDevice
CreateFile(\\\\.\\LBK1 ...) status
ReadFile(hDevice, ...) status
WriteFile(hDevice, ...) status
DeviceIoControl(hDevice, ...) status
CloseHandle(hDevice, ...)
ltWin32 ?? ??? ????gt
37
?? ??? ???? ??
38
Summary
39
Summary

• ???? ???? ??? ????? I/O ???
• ?? ?????? ????.
• ????? ??, ?? ??? ???? I/O ????
• ????.