26、Windows驱动程序的同步处理(2)

4、内核模式下的同步对象

用户模式下用句柄来操作同步对象，而内核模式下可以获得同步对象的指针。每种同步对象在内核中均对应一种数据结构。

1）等待

KeWaitForMultipleObjects

KeWaitForSingleObject

如果超时则返回STATUS_TIMEOUT。如果是因为数组中其一个同步对象变为激发态，则函数的返回值减去STATUS_WAIT_0，就是激发的同步对象在数组中的索引号。

2）多线程

PsCreateSystemThread 包括用户线程与系统线程。用户线程属于当前进程（当前IO操作的发起者；如在IRP_MJ_READ的派遣函数中调用 PsCreateSystemThread创建用户线程，新线程属于调用ReadFile的进程）中的线程。系统线程一般是System线程。

创建的线程必须手动用PsTerminateSystemThread结束。PEPROCESS记录进程信息。

代码

 1 #include "ntddk.h"
 2 VOID SystemThread(IN PVOID pContext)
 3 {
 4     KdPrint(("Enter SystemThread\n"));
 5     PEPROCESS pEProcess = IoGetCurrentProcess();
 6     PTSTR ProcessName = (PTSTR)((ULONG)pEProcess + 0x174);
 7     KdPrint(("this thread is run in %s process!\n", ProcessName));
 8     KdPrint(("Leave SystemThread\n"));
 9     PsTerminateSystemThread (NT_STATUS);
10 }
11 
12 VOID MyProcessThread(IN PVOID pContext)
13 {
14     KdPrint(("Enter MyProcessThread\n"));
15     PEPROCESS pEProcess = IoGetCurrentProcess();
16     PTSTR ProcessName = (PTSTR)((ULONG)pEProcess + 0x174);
17     KdPrint(("this thread is run in %s process!\n", ProcessName));
18     KdPrint(("Leave MyProcessThread\n"));
19     PsTerminateSystemThread (NT_STATUS);
20 }
21 
22  void CreateThread_Test()
23 {
24     HANDLE hSystemThread, hMyThread;
25     NTSTATUS status = PsCreateSystemThread(&hSystemThread, 0, NULL, NULL, NULL, SystemThread, NULL);
26     NTSTATUS status = PsCreateSystemThread(&hMyThread, 0, NULL, NULL, NULL, MyProcessThread, NULL);
27 }

示例代码 P236

3）内核模式下的事件对象

KEVENT

KeInitializeEvent

代码

 1 void MyProcessThread(IN VOID pContext)
 2 {
 3     PKEVENT pEvent = (PKEVENT)pContext;
 4     kdPrint(("Enter MyProcessThread\n"));
 5     KeSetEvent(pEvent, IO_NO_INCREMENT, FALSE);
 6     kdPrint(("Leave MyProcessThread\n"));
 7     PsTerminateSystemThread (NT_STATUS);
 8 }
 9  void  Test()
10 {
11 HANDLE hMyThread;
12 KEVENT kEvent;
13 KeInitializeEvent(&kEvent, NotificationEvent, FALSE);
14 NTSTATUS status = PsCreateSystemThread(&hMyThread, 0, NULL, NtCurrentProcess(), NULL, MyProcessThread, &kEvent);
15 keWaitforSingleobject(&kEvent, Executive, KernalMode, FALSE, NULL);
16 }

示例代码 P237

4）驱动程序与应用程序交互事件对象

在用户模式下创建一个同步事件，然后用DeviceIoControl把事件句柄传递给驱动程序。句柄是与进程相关的，一个进程中的句柄只能在这个进程中有效，句柄相当于事件对象在进程中的索引。DDK中提供了如下函数：

ObReferenceObjectByHandle

ObDereferenceObject

ObReferenceObjectByHandle 在得到指针的同时，会为对象的指针维护一个计数，每次调用ObReferenceObjectByHandle会使计数加1；为使计数平衡，应当在后面适当时候调用ObDereferenceObject 来使计数减一。

代码

 1 int main()
 2 {
 3     HANDLE hDevice = CreateFile("\\\\.\\HelloDDK",
 4                                 GENERIC_READ |GENERIC_WRITE,
 5                                 0,
 6                                 NULL,
 7                                 OPEN_EXISTING,
 8                                 FILE_ATTRIBUTE_NORMAL,
 9                                 NULL);
10     if (hDevice == INVALID_HANDLE_VALUE)
11     {
12         printf("Failed to obtain file handle to device:%s with win32 error code:%d\n","MYWDMDevice", GetLastError());
13         return 1;
14     }
15     bool bRet;
16     DWORD dwOutput;
17     HANDLE hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
18     //建立辅助线程
19      HANDLE hThread1 = (HANDLE)_beginthreadex(NULL, 0, Thread1, &hEvent, 0, NULL);
20     //将用户模式下的事件句柄传递给驱动
21     //IOCTL_TRANSMIT_EVENT是自己定义的CODE
22      bRet = DeviceIoControl(hDevice, 
23                             IOCTL_TRANSMIT_EVENT, 
24                             &hEvent,
25                             sizeof(hEvent),
26                             NULL, 
27                             0, 
28                             &dwOutput, 
29                             NULL);
30     WaitForSingleObject(hThread1, INFINITE);
31     CloseHandle(hDevice);
32     CloseHandle(hThread1);
33     CloseHandle(hEvent);
34     return 0;
35 }
36 
37 NTSTATUS HelloDDKDeviceIoControl(IN PDEVICE_OBJECT pDevObj,
38                                  IN PIRP pIrp)
39 {
40     NTSTATUS status = STATUS_SUCESS;
41     KdPrint(("Enter HelloDDKDeviceIoControl\n"));
42     PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(pIrp);
43     //获得输入参数大小 
44     ULONG cbin = stack->Parameters.DeviceIoControl.InputBufferLength;
45     //获得输出参数大小
46     ULONG cbout = stack->Parameters.DeviceIoControl.OutPutBufferLength;
47     //获得IOCTL码
48     ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
49     ULONG info = 0;
50     switch (code)
51     {
52     case IOCTL_TRANSMIT_EVENT:
53         {
54         //得到应用程序传进来的事件
55         HANDLE hUserEvent = *(HANDLE*)pIrp->AssociatedIrp.SystemBuffer;
56         PKEVENT pEvent;
57         status = ObReferenceObjectByHandle(hUserEvent, EVENT_MODIFY_STATE, *ExEventObjecttype,
58                                             kernalmode,
59                                             (PVOID*)&pEvent, NULL);
60         keSetEvent(pEvent, IO_NO_INCREMENT, FALSE);
61         ObDereferenceObject(pEvent);
62         break;
63         }
64     default:
65         status = STATUS_INVALID_PARAMETER;
66     }
67     pIrp->IoStatus.Status = status;
68     pIrp->IoStatus.Information = info;
69     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
70     return status;
71 }

示例代码 P238

5）驱动程序与驱动程序间交互事件对象

最简单的方法是创建一个有名字的事件对象，这样在另一个驱动程序中就可以根据名字来寻找到事件对象的指针。

6）内核模式下的信号灯

用户模式下，信号灯对象用句柄表示，在内核模式下，用ksemaphore结构表示。

KeInitializeSemaphore

KeReadStateSemaphore

KeReleaseSemaphore 释放信号灯会增加计数

KeWaitXXX可获取信号灯，如果成功获得，计数减一，否则等待。

示例代码 P240，基本原理同上，略

7）内核模式下的互斥体

KeInitializeMutex

KeReleaseMutex

代码

1 VOID MyProcessThread1(IN PVOID pContext)
2 {
3 PKMUTEX pkMutex = (PKMUTEX)pContext;
4 keWaitforSingleobject(pkMutex, Executive, KernalMode, FALSE, NULL);
5 kdPrint(("Enter MyProcessThread1\n"));
6 //停止50ms
7 KeStallExecutionProcessor(50);
8 kdPrint(("Leave MyProcessThread1\n"));
9 KeReleaseMutex(pkMutex, FALSE);
10 PsTerminateSystemThread(STATUS_SUCCESS);
11 }
12
13 VOID MyProcessThread2(IN PVOID pContext)
14 {
15 PKMUTEX pkMutex = (PKMUTEX)pContext;
16 keWaitforSingleobject(pkMutex, Executive, KernalMode, FALSE, NULL);
17 kdPrint(("Enter MyProcessThread2\n"));
18 //停止50ms
19 KeStallExecutionProcessor(50);
20 kdPrint(("Leave MyProcessThread2\n"));
21 KeReleaseMutex(pkMutex, FALSE);
22 PsTerminateSystemThread(STATUS_SUCCESS);
23 }
24 #pragma PAGEDCODE
25 VOID Test()
26 {
27 HANDLE hMyThread1, hMyThread2;
28 KMUTEX hMutex;
29 KeInitializeMutex(&hMutex, 0);
30 NTSTATUS status = PsCreateSystemThread(&hMyThread1, 0, NULL, NtCurrentProcess(), NULL, MyProcessThread1, &hMutex);
31 NTSTATUS status2 = PsCreateSystemThread(&hMyThread2, 0, NULL, NtCurrentProcess(), NULL, MyProcessThread2, &hMutex);
32 PVOID Pointer_Array[2];
33 ObReferenceObjectByHandle(hMyThread1, 0, NULL,
34 kernalmode,
35 Pointer_Array[0],
36 NULL);
37 ObReferenceObjectByHandle(hMyThread2, 0, NULL,
38 kernalmode,
39 Pointer_Array[1],
40 NULL);
41 KeWaitForMultipleObjects(2, Pointer_Array, WaitAll, Executive, KernelMode,
42 FALSE, NULL, NULL);
43 ObDereferenceObject(Pointer_Array[0]);
44 ObDereferenceObject(Pointer_Array[1]);
45 kdPrint(("After KeWaitForMultipleObjects\n"));
46 }

示例代码 P242

8）快速互斥体

比普通互斥体快。不过不能递归获取互斥体对象。普通互斥体数据结构是MUTEX，快带互斥体是FAST_MUTEX。

示例代码 P244 基本原理同上，只是数据结构变了，此略

4、其他同步方法

1）使用自旋锁

KeInitializeSpinLock

KeReleaseSpinLock

代码

 1 #include "windows.h"
 2 #include "process.h"
 3 #include "stdio.h"
 4 #include "winioctl.h"
 5 #define "..\NT_Driver\Ioctls.h"
 6 
 7 UINT WINAPI Thread1(LPVOID pContext)
 8 {
 9     BOOL bRet;
10     DWORD dwOutput;
11     bRet = DeviceIoControl(*(PHANDLE)pContext, 
12         IOCTL_MYDEFINITION, 
13         NULL,
14         0,
15         NULL, 
16         0, 
17         &dwOutput, 
18         NULL);
19     return 0;
20 }
21 
22 int main()
23 {
24     HANDLE hDevice = CreateFile("\\\\.\\HelloDDK",
25         GENERIC_READ |GENERIC_WRITE,
26         0,
27         NULL,
28         OPEN_EXISTING,
29         FILE_ATTRIBUTE_NORMAL,
30         NULL);
31     if (hDevice == INVALID_HANDLE_VALUE)
32     {
33         printf("Failed to obtain file handle to device:%s with win32 error code:%d\n","MYWDMDevice", GetLastError());
34         return 1;
35     }
36     HANDLE hThread1 = (HANDLE)_beginthreadex(NULL, 0, Thread1, &hDevice, 0, NULL);
37     HANDLE hThread2 = (HANDLE)_beginthreadex(NULL, 0, Thread1, &hDevice, 0, NULL);
38     WaitForMultipleObjects(2, hThread, TRUE, INFINITE);
39     CloseHandle(hThread1);
40     CloseHandle(hThread2);
41     CloseHandle(hDevice);
42     return 0;
43 }
44 
45 NTSTATUS HelloDDKDeviceIoControl(IN PDEVICE_OBJECT pDevObj,
46                                  IN PIRP pIrp)
47 {
48     ASSERT(KeGetCurrentIrpl() == PASSIVE_LEVLE));
49     PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pDevObj->DeviceExtension;
50     KIRQL oldirql;
51     KeAcquireSpinLock(&pdx->My_SpinLock, &oldirql);
52     //...开始
53     ASSERT(KeGetCurrentIrpl() == DISPATCH_LEVEL));
54     pIrp->IoStatus.Status = STATUS_SUCCESS;
55     pIrp->IoStatus.information = 0;
56     IoCompleteRequest(pIrp, IO_NO_INCREMENT);
57     NTSTATUS status = STATUS_SUCESS;
58     //...结束
59     KeReleaseSpinLock(&pdx->My_SpinLock, oldirql);
60     return status;
61 }

示例代码 P245

2）互锁操作进行同步

在多线程操作中，对于全局变量的自增、自减等操作，可能不同时候操作，结果是不一样的。因为一个自增等操作翻译成汇编是多条语句，多个线程访问导致了不可重入性。解决方法一是通过自旋锁等同步操作，另外一个方法，便是下面介绍的互锁操作。

保证操作的原子性。DDK提供了如下函数：

InterlockedXX

ExInterlockedXX

 1 int number = 0;
 2 void Foo()
 3 {
 4     KeAcquireSpinLock(...)
 5         number++;
 6     KeReleaseSpinLock(...)
 7 }
 8 
 9 int number2 = 0;
10 void Foo2()
11 {
12     InterlockedIncrement(&number2);//原子方式的自增
13 }

前者不通过自旋锁实现，内部不会提升IRQL，可以操作非分页数据和分页数据；后者是通过自旋锁实现的，需要程序员提供一个自旋锁，不能操作分页内存的数据。

ExInterlockedXX

内核函数	功能
ExInterlockedAddLargeInteger	64位整数加法互锁操作
ExInterlockedAddLargeStatistic	64位整数加法互锁操作
ExInterlockedAddUlong	32位整数加法互锁操作
ExInterlockedAllocateFromZone	分配互锁操作
ExInterlockedCompareExchange64	两个32位整数互换互锁操作
ExInterlockedDecrementLong	32位整数减法互锁操作
ExInterlockedExchangeAddLargeInteser	64为整数加法互锁操作
ExInterlockedExchangeUlong	两个整数互换互锁操作
ExInterlockedFlushSList	删除链表全部元素的互锁操作
ExInterlockedIncrementLong	32位整数自增互锁操作
ExInterlockedInsertHeadList	插入双向链表互锁操作
ExInterlockedInsertTailList	插入双向链表互锁操作
ExInterlockedPopEntryList	删除单向链表互锁操作
ExInterlockedPopEntrySList	删除单向链表互锁操作
ExInterlockedPushEntryList	插入单向链表互锁操作
ExInterlockedPushEntrySList	插入单向链表互锁操作
ExInterlockedRemoveHeadList	插入双向链表互锁操作

InterlockedXX

内核函数	功能
InterlockedCompareExchange	比较互锁操作
InterlockedCompareExchangePointer	比较互锁操作
InterlockedDecrement	整型自减互锁操作
InterlockedExchange	整型交换互锁操作
InterlockedExchangeAdd	两个整型相加互锁操作
InterlockedExchangePinter	为指针赋值互锁操作
InterlockedIncrement	整型自增互锁操作