reactos操作系统实现(87)

应用程序对设备I/O进行Win32调用，这个调用由I/O系统服务接收，然后I/O管理器从这个请求构造一个合适的I/O请求包（IRP）。那么I/O管理器是怎么样创建这个I/O请求包（IRP）的呢？又是怎么样传送给驱动程序的呢？我们带着这两个问题来分析下面实现文件读取的代码，如下：

#001 NTSTATUS

#002 NTAPI

#003 NtReadFile(IN HANDLE FileHandle,

#004 IN HANDLE Event OPTIONAL,

#005 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,

#006 IN PVOID ApcContext OPTIONAL,

#007 OUT PIO_STATUS_BLOCK IoStatusBlock,

#008 OUT PVOID Buffer,

#009 IN ULONG Length,

#010 IN PLARGE_INTEGER ByteOffset OPTIONAL,

#011 IN PULONG Key OPTIONAL)

#012 {

#013 NTSTATUS Status = STATUS_SUCCESS;

#014 PFILE_OBJECT FileObject;

#015 PIRP Irp;

#016 PDEVICE_OBJECT DeviceObject;

#017 PIO_STACK_LOCATION StackPtr;

#018 KPROCESSOR_MODE PreviousMode = KeGetPreviousMode();

#019 PKEVENT EventObject = NULL;

#020 LARGE_INTEGER CapturedByteOffset;

#021 ULONG CapturedKey = 0;

#022 BOOLEAN Synchronous = FALSE;

#023 PMDL Mdl;

#024 PAGED_CODE();

#025 CapturedByteOffset.QuadPart = 0;

#026 IOTRACE(IO_API_DEBUG, "FileHandle: %p/n", FileHandle);

#027

检查是否在用户模式调用。

#028 /* Validate User-Mode Buffers */

#029 if(PreviousMode != KernelMode)

#030 {

使用SEH机制，以便截取异常。

#031 _SEH2_TRY

#032 {

检测状态块。

#033 /* Probe the status block */

#034 ProbeForWriteIoStatusBlock(IoStatusBlock);

#035

检查读取缓冲区。

#036 /* Probe the read buffer */

#037 ProbeForWrite(Buffer, Length, 1);

#038

#039 /* Check if we got a byte offset */

#040 if (ByteOffset)

#041 {

#042 /* Capture and probe it */

#043 CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);

#044 }

#045

#046 /* Capture and probe the key */

#047 if (Key) CapturedKey = ProbeForReadUlong(Key);

#048 }

#049 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#050 {

#051 /* Get the exception code */

#052 Status = _SEH2_GetExceptionCode();

#053 }

#054 _SEH2_END;

#055

#056 /* Check for probe failure */

#057 if (!NT_SUCCESS(Status)) return Status;

#058 }

#059 else

#060 {

#061 /* Kernel mode: capture directly */

#062 if (ByteOffset) CapturedByteOffset = *ByteOffset;

#063 if (Key) CapturedKey = *Key;

#064 }

#065

获取文件对象。

#066 /* Get File Object */

#067 Status = ObReferenceObjectByHandle(FileHandle,

#068 FILE_READ_DATA,

#069 IoFileObjectType,

#070 PreviousMode,

#071 (PVOID*)&FileObject,

#072 NULL);

#073 if (!NT_SUCCESS(Status)) return Status;

#074

检查事件是否响应。

#075 /* Check for event */

#076 if (Event)

#077 {

#078 /* Reference it */

#079 Status = ObReferenceObjectByHandle(Event,

#080 EVENT_MODIFY_STATE,

#081 ExEventObjectType,

#082 PreviousMode,

#083 (PVOID*)&EventObject,

#084 NULL);

#085 if (!NT_SUCCESS(Status))

#086 {

#087 /* Fail */

#088 ObDereferenceObject(FileObject);

#089 return Status;

#090 }

#091

#092 /* Otherwise reset the event */

#093 KeClearEvent(EventObject);

#094 }

#095

检查是否使用同步I/O的方式。

#096 /* Check if we should use Sync IO or not */

#097 if (FileObject->Flags & FO_SYNCHRONOUS_IO)

#098 {

这里是使用同步模式。

#099 /* Lock the file object */

#100 IopLockFileObject(FileObject);

#101

#102 /* Check if we don't have a byte offset avilable */

#103 if (!(ByteOffset) ||

#104 ((CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION) &&

#105 (CapturedByteOffset.u.HighPart == -1)))

#106 {

#107 /* Use the Current Byte Offset instead */

#108 CapturedByteOffset = FileObject->CurrentByteOffset;

#109 }

#110

#111 /* Remember we are sync */

#112 Synchronous = TRUE;

#113 }

#114 else if (!(ByteOffset) &&

#115 !(FileObject->Flags & (FO_NAMED_PIPE | FO_MAILSLOT)))

#116 {

非法文件对象。

#117 /* Otherwise, this was async I/O without a byte offset, so fail */

#118 if (EventObject) ObDereferenceObject(EventObject);

#119 ObDereferenceObject(FileObject);

#120 return STATUS_INVALID_PARAMETER;

#121 }

#122

从文件里获取设备对象。

#123 /* Get the device object */

#124 DeviceObject = IoGetRelatedDeviceObject(FileObject);

#125

#126 /* Clear the File Object's event */

#127 KeClearEvent(&FileObject->Event);

#128

分配一个读取文件的请求包（IRP）。

#129 /* Allocate the IRP */

#130 Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);

#131 if (!Irp) return IopCleanupFailedIrp(FileObject, NULL, NULL);

#132

设置IRP的属性。

#133 /* Set the IRP */

#134 Irp->Tail.Overlay.OriginalFileObject = FileObject;

#135 Irp->Tail.Overlay.Thread = PsGetCurrentThread();

#136 Irp->RequestorMode = PreviousMode;

#137 Irp->Overlay.AsynchronousParameters.UserApcRoutine = ApcRoutine;

#138 Irp->Overlay.AsynchronousParameters.UserApcContext = ApcContext;

#139 Irp->UserIosb = IoStatusBlock;

#140 Irp->UserEvent = EventObject;

#141 Irp->PendingReturned = FALSE;

#142 Irp->Cancel = FALSE;

#143 Irp->CancelRoutine = NULL;

#144 Irp->AssociatedIrp.SystemBuffer = NULL;

#145 Irp->MdlAddress = NULL;

#146

设置IRP的调用栈。

#147 /* Set the Stack Data */

#148 StackPtr = IoGetNextIrpStackLocation(Irp);

#149 StackPtr->MajorFunction = IRP_MJ_READ;

#150 StackPtr->FileObject = FileObject;

#151 StackPtr->Parameters.Read.Key = CapturedKey;

#152 StackPtr->Parameters.Read.Length = Length;

#153 StackPtr->Parameters.Read.ByteOffset = CapturedByteOffset;

#154

检查设备对象是否使用缓冲I/O的方式，还是使用直接I/O的方式。

#155 /* Check if this is buffered I/O */

#156 if (DeviceObject->Flags & DO_BUFFERED_IO)

#157 {

使用缓冲I/O的方式，就分配非分页内存。

#158 /* Check if we have a buffer length */

#159 if (Length)

#160 {

#161 /* Enter SEH */

#162 _SEH2_TRY

#163 {

#164 /* Allocate a buffer */

#165 Irp->AssociatedIrp.SystemBuffer =

#166 ExAllocatePoolWithTag(NonPagedPool,

#167 Length,

#168 TAG_SYSB);

#169 }

#170 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#171 {

#172 /* Allocating failed, clean up */

#173 IopCleanupAfterException(FileObject, Irp, EventObject, NULL);

#174 Status = _SEH2_GetExceptionCode();

#175 }

#176 _SEH2_END;

#177 if (!NT_SUCCESS(Status)) return Status;

#178

#179 /* Set the buffer and flags */

#180 Irp->UserBuffer = Buffer;

#181 Irp->Flags = (IRP_BUFFERED_IO |

#182 IRP_DEALLOCATE_BUFFER |

#183 IRP_INPUT_OPERATION);

#184 }

#185 else

#186 {

#187 /* Not reading anything */

#188 Irp->Flags = IRP_BUFFERED_IO | IRP_INPUT_OPERATION;

#189 }

#190 }

#191 else if (DeviceObject->Flags & DO_DIRECT_IO)

#192 {

使用直接I/O的方式，就创建内存描述符列表。

#193 /* Check if we have a buffer length */

#194 if (Length)

#195 {

#196 _SEH2_TRY

#197 {

#198 /* Allocate an MDL */

#199 Mdl = IoAllocateMdl(Buffer, Length, FALSE, TRUE, Irp);

#200 MmProbeAndLockPages(Mdl, PreviousMode, IoWriteAccess);

#201 }

#202 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#203 {

#204 /* Allocating failed, clean up */

#205 IopCleanupAfterException(FileObject, Irp, EventObject, NULL);

#206 Status = _SEH2_GetExceptionCode();

#207 _SEH2_YIELD(return Status);

#208 }

#209 _SEH2_END;

#210

#211 }

#212

#213 /* No allocation flags */

#214 Irp->Flags = 0;

#215 }

#216 else

#217 {

#218 /* No allocation flags, and use the buffer directly */

#219 Irp->Flags = 0;

#220 Irp->UserBuffer = Buffer;

#221 }

#222

设置读取的标志。

#223 /* Now set the deferred read flags */

#224 Irp->Flags |= (IRP_READ_OPERATION | IRP_DEFER_IO_COMPLETION);

#225 #if 0

#226 /* FIXME: VFAT SUCKS */

#227 if (FileObject->Flags & FO_NO_INTERMEDIATE_BUFFERING) Irp->Flags |= IRP_NOCACHE;

#228 #endif

#229

调用函数IopPerformSynchronousRequest把IRP发送给过滤驱动程序，或者目标驱动程序。

#230 /* Perform the call */

#231 return IopPerformSynchronousRequest(DeviceObject,

#232 Irp,

#233 FileObject,

#234 TRUE,

#235 PreviousMode,

#236 Synchronous,

#237 IopReadTransfer);

#238 }

#239

下面继续分析写文件的操作函数，就可以知道写文件时怎么样发送I/O请求包，实现代码如下：

#001 NTSTATUS

#002 NTAPI

#003 NtWriteFile(IN HANDLE FileHandle,

#004 IN HANDLE Event OPTIONAL,

#005 IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,

#006 IN PVOID ApcContext OPTIONAL,

#007 OUT PIO_STATUS_BLOCK IoStatusBlock,

#008 IN PVOID Buffer,

#009 IN ULONG Length,

#010 IN PLARGE_INTEGER ByteOffset OPTIONAL,

#011 IN PULONG Key OPTIONAL)

#012 {

#013 NTSTATUS Status = STATUS_SUCCESS;

#014 PFILE_OBJECT FileObject;

#015 PIRP Irp;

#016 PDEVICE_OBJECT DeviceObject;

#017 PIO_STACK_LOCATION StackPtr;

获取前一个内核模式。

#018 KPROCESSOR_MODE PreviousMode = KeGetPreviousMode();

#019 PKEVENT EventObject = NULL;

#020 LARGE_INTEGER CapturedByteOffset;

#021 ULONG CapturedKey = 0;

#022 BOOLEAN Synchronous = FALSE;

#023 PMDL Mdl;

#024 OBJECT_HANDLE_INFORMATION ObjectHandleInfo;

#025 PAGED_CODE();

#026 CapturedByteOffset.QuadPart = 0;

#027 IOTRACE(IO_API_DEBUG, "FileHandle: %p/n", FileHandle);

#028

获取文件对象。

#029 /* Get File Object */

#030 Status = ObReferenceObjectByHandle(FileHandle,

#031 0,

#032 IoFileObjectType,

#033 PreviousMode,

#034 (PVOID*)&FileObject,

#035 &ObjectHandleInfo);

#036 if (!NT_SUCCESS(Status)) return Status;

#037

检查是否用户模式调用，如果是就需要使用SEH机制。

#038 /* Validate User-Mode Buffers */

#039 if(PreviousMode != KernelMode)

#040 {

#041 _SEH2_TRY

#042 {

检查是否有写文件的权限。

#043 /*

#044 * Check if the handle has either FILE_WRITE_DATA or

#045 * FILE_APPEND_DATA granted. However, if this is a named pipe,

#046 * make sure we don't ask for FILE_APPEND_DATA as it interferes

#047 * with the FILE_CREATE_PIPE_INSTANCE access right!

#048 */

#049 if (!(ObjectHandleInfo.GrantedAccess &

#050 ((!(FileObject->Flags & FO_NAMED_PIPE) ?

#051 FILE_APPEND_DATA : 0) | FILE_WRITE_DATA)))

#052 {

#053 /* We failed */

#054 ObDereferenceObject(FileObject);

#055 _SEH2_YIELD(return STATUS_ACCESS_DENIED);

#056 }

#057

获取状态代码块。

#058 /* Probe the status block */

#059 ProbeForWriteIoStatusBlock(IoStatusBlock);

#060

#061 /* Probe the read buffer */

#062 ProbeForRead(Buffer, Length, 1);

#063

#064 /* Check if we got a byte offset */

#065 if (ByteOffset)

#066 {

#067 /* Capture and probe it */

#068 CapturedByteOffset = ProbeForReadLargeInteger(ByteOffset);

#069 }

#070

#071 /* Capture and probe the key */

#072 if (Key) CapturedKey = ProbeForReadUlong(Key);

#073 }

#074 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#075 {

#076 /* Get the exception code */

#077 Status = _SEH2_GetExceptionCode();

#078 }

#079 _SEH2_END;

#080

#081 /* Check for probe failure */

#082 if (!NT_SUCCESS(Status)) return Status;

#083 }

#084 else

#085 {

#086 /* Kernel mode: capture directly */

#087 if (ByteOffset) CapturedByteOffset = *ByteOffset;

#088 if (Key) CapturedKey = *Key;

#089 }

#090

检查是否为追加的模式。

#091 /* Check if this is an append operation */

#092 if ((ObjectHandleInfo.GrantedAccess &

#093 (FILE_APPEND_DATA | FILE_WRITE_DATA)) == FILE_APPEND_DATA)

#094 {

#095 /* Give the drivers something to understand */

#096 CapturedByteOffset.u.LowPart = FILE_WRITE_TO_END_OF_FILE;

#097 CapturedByteOffset.u.HighPart = -1;

#098 }

#099

检查是否使用事件。

#100 /* Check for event */

#101 if (Event)

#102 {

#103 /* Reference it */

#104 Status = ObReferenceObjectByHandle(Event,

#105 EVENT_MODIFY_STATE,

#106 ExEventObjectType,

#107 PreviousMode,

#108 (PVOID*)&EventObject,

#109 NULL);

#110 if (!NT_SUCCESS(Status))

#111 {

#112 /* Fail */

#113 ObDereferenceObject(FileObject);

#114 return Status;

#115 }

#116

清空事件。

#117 /* Otherwise reset the event */

#118 KeClearEvent(EventObject);

#119 }

#120

检查是否使用同步I/O的方式。

#121 /* Check if we should use Sync IO or not */

#122 if (FileObject->Flags & FO_SYNCHRONOUS_IO)

#123 {

#124 /* Lock the file object */

#125 IopLockFileObject(FileObject);

#126

#127 /* Check if we don't have a byte offset avilable */

#128 if (!(ByteOffset) ||

#129 ((CapturedByteOffset.u.LowPart == FILE_USE_FILE_POINTER_POSITION) &&

#130 (CapturedByteOffset.u.HighPart == -1)))

#131 {

#132 /* Use the Current Byte Offset instead */

#133 CapturedByteOffset = FileObject->CurrentByteOffset;

#134 }

#135

#136 /* Remember we are sync */

#137 Synchronous = TRUE;

#138 }

#139 else if (!(ByteOffset) &&

#140 !(FileObject->Flags & (FO_NAMED_PIPE | FO_MAILSLOT)))

#141 {

#142 /* Otherwise, this was async I/O without a byte offset, so fail */

#143 if (EventObject) ObDereferenceObject(EventObject);

#144 ObDereferenceObject(FileObject);

#145 return STATUS_INVALID_PARAMETER;

#146 }

#147

获取文件对应的设备对象。

#148 /* Get the device object */

#149 DeviceObject = IoGetRelatedDeviceObject(FileObject);

#150

#151 /* Clear the File Object's event */

#152 KeClearEvent(&FileObject->Event);

#153

分配一个请求包（IRP）。

#154 /* Allocate the IRP */

#155 Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);

#156 if (!Irp) return IopCleanupFailedIrp(FileObject, NULL, NULL);

#157

设置IRP的属性。

#158 /* Set the IRP */

#159 Irp->Tail.Overlay.OriginalFileObject = FileObject;

#160 Irp->Tail.Overlay.Thread = PsGetCurrentThread();

#161 Irp->RequestorMode = PreviousMode;

#162 Irp->Overlay.AsynchronousParameters.UserApcRoutine = ApcRoutine;

#163 Irp->Overlay.AsynchronousParameters.UserApcContext = ApcContext;

#164 Irp->UserIosb = IoStatusBlock;

#165 Irp->UserEvent = EventObject;

#166 Irp->PendingReturned = FALSE;

#167 Irp->Cancel = FALSE;

#168 Irp->CancelRoutine = NULL;

#169 Irp->AssociatedIrp.SystemBuffer = NULL;

#170 Irp->MdlAddress = NULL;

#171

设置与IRP一致的栈空间。

#172 /* Set the Stack Data */

#173 StackPtr = IoGetNextIrpStackLocation(Irp);

#174 StackPtr->MajorFunction = IRP_MJ_WRITE;

#175 StackPtr->FileObject = FileObject;

#176 StackPtr->Flags = FileObject->Flags & FO_WRITE_THROUGH ?

#177 SL_WRITE_THROUGH : 0;

#178 StackPtr->Parameters.Write.Key = CapturedKey;

#179 StackPtr->Parameters.Write.Length = Length;

#180 StackPtr->Parameters.Write.ByteOffset = CapturedByteOffset;

#181

检查是否使用缓冲I/O的方式。

#182 /* Check if this is buffered I/O */

#183 if (DeviceObject->Flags & DO_BUFFERED_IO)

#184 {

#185 /* Check if we have a buffer length */

#186 if (Length)

#187 {

#188 /* Enter SEH */

#189 _SEH2_TRY

#190 {

#191 /* Allocate a buffer */

#192 Irp->AssociatedIrp.SystemBuffer =

#193 ExAllocatePoolWithTag(NonPagedPool,

#194 Length,

#195 TAG_SYSB);

#196

#197 /* Copy the data into it */

#198 RtlCopyMemory(Irp->AssociatedIrp.SystemBuffer, Buffer, Length);

#199 }

#200 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#201 {

#202 /* Allocating failed, clean up */

#203 IopCleanupAfterException(FileObject, Irp, EventObject, NULL);

#204 Status = _SEH2_GetExceptionCode();

#205 _SEH2_YIELD(return Status);

#206 }

#207 _SEH2_END;

#208

#209 /* Set the flags */

#210 Irp->Flags = (IRP_BUFFERED_IO | IRP_DEALLOCATE_BUFFER);

#211 }

#212 else

#213 {

#214 /* Not writing anything */

#215 Irp->Flags = IRP_BUFFERED_IO;

#216 }

#217 }

#218 else if (DeviceObject->Flags & DO_DIRECT_IO)

#219 {

这里使用直接I/O的模式，因此调用IoAllocateMdl来创建内存描述符表。

#220 /* Check if we have a buffer length */

#221 if (Length)

#222 {

#223 _SEH2_TRY

#224 {

#225 /* Allocate an MDL */

#226 Mdl = IoAllocateMdl(Buffer, Length, FALSE, TRUE, Irp);

#227 MmProbeAndLockPages(Mdl, PreviousMode, IoReadAccess);

#228 }

#229 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)

#230 {

#231 /* Allocating failed, clean up */

#232 IopCleanupAfterException(FileObject, Irp, EventObject, NULL);

#233 Status = _SEH2_GetExceptionCode();

#234 _SEH2_YIELD(return Status);

#235 }

#236 _SEH2_END;

#237 }

#238

#239 /* No allocation flags */

#240 Irp->Flags = 0;

#241 }

#242 else

#243 {

#244 /* No allocation flags, and use the buffer directly */

#245 Irp->Flags = 0;

#246 Irp->UserBuffer = Buffer;

#247 }

#248

#249 /* Now set the deferred read flags */

#250 Irp->Flags |= (IRP_WRITE_OPERATION | IRP_DEFER_IO_COMPLETION);

#251 #if 0

#252 /* FIXME: VFAT SUCKS */

#253 if (FileObject->Flags & FO_NO_INTERMEDIATE_BUFFERING) Irp->Flags |= IRP_NOCACHE;

#254 #endif

#255

调用函数IopPerformSynchronousRequest来分IRP请求包给相应的驱动程序。

#256 /* Perform the call */

#257 return IopPerformSynchronousRequest(DeviceObject,

#258 Irp,

#259 FileObject,

#260 TRUE,

#261 PreviousMode,

#262 Synchronous,

#263 IopWriteTransfer);

#264 }