Pass event events defined by the user layer to the Windows kernel driver and respond to kernel-level notifications

Source: Internet
Author: User

Complete program at Download: http://download.csdn.net/detail/dijkstar/7913249

The event created by the user layer is an handle handle, and the kernel-created kernel mode of kevent is a thing. As a result, events created at the application layer can be obtained and used at the kernel level. This part of the principle, see Zhang Fan authored "Windows Drive Technology detailed" chapter 8.5.4,p237 page;

The program comes from the section 8.5.4 (Driver and Application interaction event objects) and Chapter 10.2.1 (DPC Timers) in the Windows Driver Technical detail chapter.

First, create a wait event in the application layer, create a thread that monitors the wait event, and pass the Wait event event to the kernel:

  1. //
  2. //1. Creating a wait event for the user layer, passing in the kernel
  3. //2. Creating threads for monitoring the arrival of kernel events
  4. //
  5. HANDLE hevent = CreateEvent (null, False, False, null);
  6. HANDLE hthread = (HANDLE) _beginthreadex (NULL, 0, Thread1, &hevent, 0, null);
  7. //The wait event of the user layer is passed into the kernel first
  8. DeviceIoControl (Hdevice, Ioctl_set_event, &hevent, sizeof(hevent), NULL, 0, & Dwoutput, NULL);

Monitor the contents of the thread: (it uses the number of query instruction cycles, you can test each wait waitforxx time)

  1. UINT WINAPI Thread1(lpvoid para)
  2. {
  3. HANDLE *phevent = (HANDLE *) para;
  4. while (1)
  5. {
  6. //Get initial value
  7. QueryPerformanceCounter (&LITMP);
  8. Qt1=litmp. QuadPart;
  9. //Wait
  10. WaitForSingleObject (*phevent, INFINITE);
  11. //Get termination value
  12. QueryPerformanceCounter (&LITMP);
  13. Qt2=litmp. QuadPart;
  14. //Get the corresponding time value, go to the millisecond unit
  15. Dfm= (double) (QT2-QT1);
  16. DFT=DFM/DFF;
  17. printf ("Time of this wait:%.3f MS \ n", dft*1000.0);
  18. }
  19. }

The user layer also notifies the driver kernel to launch a DPC timer that is used to trigger the application layer's wait event events each time:

    1. DWORD dwmircoseconds = *; //Unit microseconds
    2. DeviceIoControl (Hdevice, Ioctl_start_timer, &dwmircoseconds, sizeof(DWORD), NULL, 0, &dwoutput, NULL);

In the driver, you first take out the event that the application layer passes in and convert it into a kernel object:

    1. Case Ioctl_set_event:
    2. {
    3. //Pass in the user layer waiting for the event to take out
    4. HANDLE huserevent = * (HANDLE *) pirp->associatedirp.systembuffer;
    5. //Convert user layer event to kernel wait object
    6. Status = Obreferenceobjectbyhandle (Huserevent, Event_modify_state,
    7. *exeventobjecttype, KernelMode, (pvoid*) &pdevext->pevent, NULL);
    8. Kdprint (("status =%d\n", status)); //status's supposed to be 0 .
    9. Obdereferenceobject (pdevext->pevent);
    10. break;
    11. }

When each timer arrives in the kernel, the activation wait event is equal to the WAITFORXX function that triggers the activation of the application layer to continue execution:

  1. #pragma lockedcode
  2. VOID pollingtimerdpc(in pkdpc pdpc,
  3. in PVOID PContext,
  4. in PVOID SysArg1,
  5. In PVOID SysArg2)
  6. {
  7. Pdevice_object pdevobj = (pdevice_object) pContext;
  8. Pdevice_extension PDX = (pdevice_extension) pdevobj->deviceextension;
  9. Kesettimer (
  10. &pdx->pollingtimer,
  11. Pdx->pollinginterval,
  12. &PDX->POLLINGDPC);
  13. Kdprint (("pollingtimerdpc\n"));
  14. //Timer arrives, notifies the user layer
  15. if (pdx->pevent)
  16. KeSetEvent (Pdx->pevent, Io_no_increment, FALSE);
  17. /*
  18. //check is run in any thread context
  19. peprocess peprocess = iogetcurrentprocess ();
  20. ptstr ProcessName = (ptstr) ((ULONG) peprocess + 0x174);
  21. Kdprint (("%s\n", ProcessName));
  22. */
  23. }

The other parts of the program see the Source code interpretation, this program has two problems, one is that the application layer must exit normally, or drive the kernel layer because the DPC timer can not be properly shut down, and continue to do not find the wait events, causing the blue screen crash; second, although in the kernel, the DPC timer has a trigger accuracy of 1 100ns levels. , but when the trigger period is set to below 20ms, it is not meaningful to monitor waitfor at the application layer, which is more than 10 milliseconds resolution precision, and then down setting.

JPG change rar

Pass event events defined by the user layer to the Windows kernel driver and respond to kernel-level notifications

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.