Windows NT Driver >> C/C++

Cancel IRP

---

參考資訊：
1. Source Code
2. canceling-irps

有處理Irp就會有Cancel Irp的時候，Cancel Irp本身就是一個很複雜的課題，司徒在這一篇教學不會做深入探討，有興趣的使用者可以參考上面的參考資訊，取而代之的，司徒只是點出，在處理Irp時，使用者要意識到該Irp可能已經被Cancel掉了，作法上，也是可以切割成很多時期，如：Irp處理前，Irp處裡中，Irp處裡後，因此，在設計驅動程式時，對於Cancel機制有必要嚴謹看待，因為，BSOD常常就是這樣發生了，不過司徒在此僅針對Irp處裡前，作簡單判斷，是否User Application已經Cancel這個Irp，如果沒有被Cancel，則Complete Irp，相反地，如果被Cancel，則Cancel Irp，Cancel作法如下：
1. CancelRoutine(NULL)
2. IoCompleteRequest(STATUS_CANCELLED)

main.c

#include <wdm.h>

#define IOCTL_QUEUE   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define DEV_NAME L"\\Device\\MyDriver"
#define SYM_NAME L"\\DosDevices\\MyDriver"

KDPC stDPC={0};
KTIMER stTime={0};
LIST_ENTRY stQueue={0};

VOID OnTimer(struct _KDPC *Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
{
  PIRP pIrp;
  PLIST_ENTRY plist;
  if(IsListEmpty(&stQueue) == TRUE){
    KeCancelTimer(&stTime);
    DbgPrint("Finish");
  }
  else{
    plist = RemoveHeadList(&stQueue);
    pIrp = CONTAINING_RECORD(plist, IRP, Tail.Overlay.ListEntry);
    if(pIrp->Cancel != TRUE){
      pIrp->IoStatus.Status = STATUS_SUCCESS;
      pIrp->IoStatus.Information = 0;
      IoCompleteRequest(pIrp, IO_NO_INCREMENT);
      DbgPrint("Complete Irp");
    }
    else{
      pIrp->CancelRoutine = NULL;
      pIrp->IoStatus.Status = STATUS_CANCELLED;
      pIrp->IoStatus.Information = 0;
      IoCompleteRequest(pIrp, IO_NO_INCREMENT);
      DbgPrint("Cancel Irp");
    }
  }
}

void Unload(PDRIVER_OBJECT pOurDriver)
{
  UNICODE_STRING usSymboName;
                
  RtlInitUnicodeString(&usSymboName, L"\\DosDevices\\MyDriver");
  IoDeleteSymbolicLink(&usSymboName);
  IoDeleteDevice(pOurDriver->DeviceObject);
}

NTSTATUS IrpIOCTL(PDEVICE_OBJECT pOurDevice, PIRP pIrp)
{
  LARGE_INTEGER stTimePeriod;
  PIO_STACK_LOCATION psk = IoGetCurrentIrpStackLocation(pIrp);

  switch(psk->Parameters.DeviceIoControl.IoControlCode){
  case IOCTL_QUEUE:
    DbgPrint("IOCTL_QUEUE");
    InsertHeadList(&stQueue, &pIrp->Tail.Overlay.ListEntry);
    IoMarkIrpPending(pIrp);
    return STATUS_PENDING;
  case IOCTL_PROCESS:
    DbgPrint("IOCTL_PROCESS");
    stTimePeriod.HighPart|= -1;
    stTimePeriod.LowPart = -10000000;
    KeSetTimerEx(&stTime, stTimePeriod, 1000, &stDPC);
    break;
  }
  pIrp->IoStatus.Information = 0;
  pIrp->IoStatus.Status = STATUS_SUCCESS;
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

NTSTATUS IrpFile(PDEVICE_OBJECT pOurDevice, PIRP pIrp)
{
  PIO_STACK_LOCATION psk = IoGetCurrentIrpStackLocation(pIrp);

  switch(psk->MajorFunction){
  case IRP_MJ_CREATE:
    DbgPrint("IRP_MJ_CREATE");
    break;
  case IRP_MJ_CLOSE:
    DbgPrint("IRP_MJ_CLOSE");
    break;
  }
  IoCompleteRequest(pIrp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pOurDriver, PUNICODE_STRING pOurRegistry)
{
  PDEVICE_OBJECT pOurDevice=NULL;
  UNICODE_STRING usDeviceName;
  UNICODE_STRING usSymboName;
     
  pOurDriver->MajorFunction[IRP_MJ_CREATE] =
  pOurDriver->MajorFunction[IRP_MJ_CLOSE] = IrpFile;
  pOurDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = IrpIOCTL;
  pOurDriver->DriverUnload = Unload;
       
  RtlInitUnicodeString(&usDeviceName, L"\\Device\\MyDriver");
  IoCreateDevice(pOurDriver, 0, &usDeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pOurDevice);
  RtlInitUnicodeString(&usSymboName, L"\\DosDevices\\MyDriver");
  InitializeListHead(&stQueue);
  KeInitializeTimer(&stTime);
  KeInitializeDpc(&stDPC, OnTimer, pOurDevice);
  IoCreateSymbolicLink(&usSymboName, &usDeviceName);
  pOurDevice->Flags&= ~DO_DEVICE_INITIALIZING;
  pOurDevice->Flags|= DO_BUFFERED_IO;
  return STATUS_SUCCESS;
}

DriverEntry()初始List以及DPC Timer，DPC Timer用來定期確認List是否還有資料需要處理，當然，使用Thread檢查或許更恰當些
IrpIOCTL()IOCTL_QUEUE代表該IOCTL會被Queue起來，稍後處理，而當收到IOCTL_PROCESS時，則啟動DPC Timer開始處理那些被Queue起來的Irp
OnTimer()處理Queue裡面的Irp，在處理前，先判斷該Irp是否已經被Cancel了

app.c

#define INITGUID
#include <windows.h>
#include <winioctl.h>
#include <strsafe.h>
#include <setupapi.h>
#include <stdio.h>
#include <stdlib.h>

#define IOCTL_QUEUE   CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)

int __cdecl main(int argc, char* argv[])
{
  int i=0;
  DWORD dwRet = 0;
  HANDLE hFile = NULL;
  OVERLAPPED ov[3]={0};

  hFile = CreateFile("\\\\.\\MyDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED | FILE_ATTRIBUTE_NORMAL, NULL);
  if (hFile == INVALID_HANDLE_VALUE) {
    printf("failed to open mydriver\n");
    return -1;
  }
  for(i=0; i<3; i++){
    memset(&ov[i], 0, sizeof(ov[i]));
    ov[i].hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
    printf("queue event\n");
    DeviceIoControl(hFile, IOCTL_QUEUE, NULL, 0, NULL, 0, &dwRet, &ov[i]);
  }
  printf("process all of events\n");
  DeviceIoControl(hFile, IOCTL_PROCESS, NULL, 0, NULL, 0, &dwRet, NULL);
  Sleep(1000);
  CancelIo(hFile);
  for(i=0; i<3; i++){
    WaitForSingleObject(ov[i].hEvent, INFINITE);
    CloseHandle(ov[i].hEvent);
    printf("wait complete\n");
  }
  CloseHandle(hFile);
  return 0;
}

結果

返回上一頁