Pass event events defined by the user layer to the Windows kernel driver and respond to kernel-level notifications

Complete program at Download: http://download.csdn.net/detail/dijkstar/7913249

The event created by the user layer is an handle handle, and the kernel-created kernel mode of kevent is a thing. As a result, events created at the application layer can be obtained and used at the kernel level. This part of the principle, see Zhang Fan authored "Windows Drive Technology detailed" chapter 8.5.4,p237 page;

The program comes from the section 8.5.4 (Driver and Application interaction event objects) and Chapter 10.2.1 (DPC Timers) in the Windows Driver Technical detail chapter.

First, create a wait event in the application layer, create a thread that monitors the wait event, and pass the Wait event event to the kernel:

2. //
4. //1. Creating a wait event for the user layer, passing in the kernel
6. //2. Creating threads for monitoring the arrival of kernel events
8. //
10. HANDLE hevent = CreateEvent (null, False, False, null);
12. HANDLE hthread = (HANDLE) _beginthreadex (NULL, 0, Thread1, &hevent, 0, null);
16. //The wait event of the user layer is passed into the kernel first
18. DeviceIoControl (Hdevice, Ioctl_set_event, &hevent, sizeof(hevent), NULL, 0, & Dwoutput, NULL);

Monitor the contents of the thread: (it uses the number of query instruction cycles, you can test each wait waitforxx time)

2. UINT WINAPI Thread1(lpvoid para)
4. {
6. HANDLE *phevent = (HANDLE *) para;
8. while (1)
10. {
12. //Get initial value
14. QueryPerformanceCounter (&LITMP);
16. Qt1=litmp. QuadPart;
20. //Wait
22. WaitForSingleObject (*phevent, INFINITE);
28. //Get termination value
30. QueryPerformanceCounter (&LITMP);
32. Qt2=litmp. QuadPart;
34. //Get the corresponding time value, go to the millisecond unit
36. Dfm= (double) (QT2-QT1);
38. DFT=DFM/DFF;
44. printf ("Time of this wait:%.3f MS \ n", dft*1000.0);
46. }
48. }

The user layer also notifies the driver kernel to launch a DPC timer that is used to trigger the application layer's wait event events each time:

1. DWORD dwmircoseconds = *; //Unit microseconds
2. DeviceIoControl (Hdevice, Ioctl_start_timer, &dwmircoseconds, sizeof(DWORD), NULL, 0, &dwoutput, NULL);

In the driver, you first take out the event that the application layer passes in and convert it into a kernel object:

1. Case Ioctl_set_event:
2. {
3. //Pass in the user layer waiting for the event to take out
4. HANDLE huserevent = * (HANDLE *) pirp->associatedirp.systembuffer;
6. //Convert user layer event to kernel wait object
7. Status = Obreferenceobjectbyhandle (Huserevent, Event_modify_state,
8. *exeventobjecttype, KernelMode, (pvoid*) &pdevext->pevent, NULL);
10. Kdprint (("status =%d\n", status)); //status's supposed to be 0 .
12. Obdereferenceobject (pdevext->pevent);
13. break;
14. }

When each timer arrives in the kernel, the activation wait event is equal to the WAITFORXX function that triggers the activation of the application layer to continue execution:

2. #pragma lockedcode
4. VOID pollingtimerdpc(in pkdpc pdpc,
6. in PVOID PContext,
8. in PVOID SysArg1,
10. In PVOID SysArg2)
12. {
14. Pdevice_object pdevobj = (pdevice_object) pContext;
16. Pdevice_extension PDX = (pdevice_extension) pdevobj->deviceextension;
18. Kesettimer (
20. &pdx->pollingtimer,
22. Pdx->pollinginterval,
24. &PDX->POLLINGDPC);
26. Kdprint (("pollingtimerdpc\n"));
30. //Timer arrives, notifies the user layer
32. if (pdx->pevent)
34. KeSetEvent (Pdx->pevent, Io_no_increment, FALSE);
40. /*
42. //check is run in any thread context
44. peprocess peprocess = iogetcurrentprocess ();
46. ptstr ProcessName = (ptstr) ((ULONG) peprocess + 0x174);
48. Kdprint (("%s\n", ProcessName));
50. */
52. }

The other parts of the program see the Source code interpretation, this program has two problems, one is that the application layer must exit normally, or drive the kernel layer because the DPC timer can not be properly shut down, and continue to do not find the wait events, causing the blue screen crash; second, although in the kernel, the DPC timer has a trigger accuracy of 1 100ns levels. , but when the trigger period is set to below 20ms, it is not meaningful to monitor waitfor at the application layer, which is more than 10 milliseconds resolution precision, and then down setting.

JPG change rar

Pass event events defined by the user layer to the Windows kernel driver and respond to kernel-level notifications