メイン   モジュール   デー タ構造   ファイルリスト   データフィールド   グローバル   関連ページ   注意事項   English

Read.c File Reference

#include <stdarg.h>
#include "ntddk.h"
#include <ntiologc.h>
#include <ndis.h>
#include "debug.h"
#include "packet.h"
#include "win_bpf.h"
#include "tme.h"
#include "time_calls.h"

Go to the source code of this file.

Functions

NTSTATUS NPF_Read (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
 Function that serves the user's reads.

NDIS_STATUS NPF_tap (IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE MacReceiveContext, IN PVOID HeaderBuffer, IN UINT HeaderBufferSize, IN PVOID LookaheadBuffer, IN UINT LookaheadBufferSize, IN UINT PacketSize)
 Callback invoked by NDIS when a packet arrives from the network.

VOID NPF_TransferDataComplete (IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET pPacket, IN NDIS_STATUS Status, IN UINT BytesTransfered)
 Ends the transfer of a packet.

VOID NPF_ReceiveComplete (IN NDIS_HANDLE ProtocolBindingContext)
 Callback function that signals the end of a packet reception.


Variables

time_conv G_Start_Time
 Global start time. Used as an absolute reference for timestamp conversion.

ULONG NCpu


Function Documentation

NTSTATUS NPF_Read IN PDEVICE_OBJECT    DeviceObject,
IN PIRP    Irp
 

Function that serves the user's reads.

Parameters:
DeviceObject Pointer to the device used by the user.
Irp Pointer to the IRP containing the user request.
Returns:
The status of the operation. See ntstatus.h in the DDK.
This function is called by the OS in consequence of user ReadFile() call. It moves the data present in the kernel buffer to the user buffer associated with Irp. First of all, NPF_Read checks the amount of data in kernel buffer associated with current NPF instance.
  • If the instance is in capture mode and the buffer contains more than OPEN_INSTANCE::MinToCopy bytes, NPF_Read moves the data in the user buffer and returns immediatly. In this way, the read performed by the user is not blocking.
  • If the buffer contains less than MinToCopy bytes, the application's request isn't satisfied immediately, but it's blocked until at least MinToCopy bytes arrive from the net or the timeout on this read expires. The timeout is kept in the OPEN_INSTANCE::TimeOut field.
  • If the instance is in statistical mode or in dump mode, the application's request is blocked until the timeout kept in OPEN_INSTANCE::TimeOut expires.

Definition at line 37 of file Read.c.

References bpf_hdr::bh_caplen, bpf_hdr::bh_datalen, bpf_hdr::bh_hdrlen, bpf_hdr::bh_tstamp, _OPEN_INSTANCE::Bound, _OPEN_INSTANCE::CountersLock, _OPEN_INSTANCE::CpuData, _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpOffset, EXIT_FAILURE, EXIT_SUCCESS, __CPU_Private_Data::Free, PacketHeader::header, IMMEDIATE, _OPEN_INSTANCE::MachineLock, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, MODE_MON, MODE_STAT, _OPEN_INSTANCE::Nbytes, NCpu, _OPEN_INSTANCE::Npackets, Packet_WORDALIGN, _OPEN_INSTANCE::ReaderSN, _OPEN_INSTANCE::ReadEvent, _OPEN_INSTANCE::Size, PacketHeader::SN, _OPEN_INSTANCE::TimeOut, and _OPEN_INSTANCE::tme.

Referenced by DriverEntry().

VOID NPF_ReceiveComplete IN NDIS_HANDLE    ProtocolBindingContext
 

Callback function that signals the end of a packet reception.

Parameters:
ProtocolBindingContext Context of the function. Contains a pointer to the OPEN_INSTANCE structure associated with the current instance.
does nothing in NPF

Definition at line 876 of file Read.c.

Referenced by DriverEntry().

NDIS_STATUS NPF_tap IN NDIS_HANDLE    ProtocolBindingContext,
IN NDIS_HANDLE    MacReceiveContext,
IN PVOID    HeaderBuffer,
IN UINT    HeaderBufferSize,
IN PVOID    LookAheadBuffer,
IN UINT    LookaheadBufferSize,
IN UINT    PacketSize
 

Callback invoked by NDIS when a packet arrives from the network.

Parameters:
ProtocolBindingContext Context of the function. Points to a OPEN_INSTANCE structure that identifies the NPF instance to which the packets are destined.
MacReceiveContext Handle that identifies the underlying NIC driver that generated the request. This value must be used when the packet is transferred from the NIC driver with NdisTransferData().
HeaderBuffer Pointer to the buffer in the NIC driver memory that contains the header of the packet.
HeaderBufferSize Size in bytes of the header.
LookAheadBuffer Pointer to the buffer in the NIC driver's memory that contains the incoming packet's data available to NPF. This value does not necessarily coincide with the actual size of the packet, since only a portion can be available at this time. The remaining portion can be obtained with the NdisTransferData() NDIS function.
LookaheadBufferSize Size in bytes of the lookahead buffer.
PacketSize Total size of the incoming packet, excluded the header.
Returns:
The status of the operation. See ntstatus.h in the DDK.
NPF_tap() is called by the underlying NIC for every incoming packet. It is the most important and one of the most complex functions of NPF: it executes the filter, runs the statistical engine (if the instance is in statistical mode), gathers the timestamp, moves the packet in the buffer. NPF_tap() is the only function, along with the filtering ones, that is executed for every incoming packet, therefore it is carefully optimized.

Definition at line 297 of file Read.c.

References __CPU_Private_Data::Accepted, _OPEN_INSTANCE::AdapterHandle, bpf_hdr::bh_caplen, bpf_hdr::bh_datalen, bpf_hdr::bh_hdrlen, bpf_hdr::bh_tstamp, bpf_filter(), bpf_filter_with_2_buffers(), _OPEN_INSTANCE::bpfprogram, _OPEN_INSTANCE::CountersLock, _OPEN_INSTANCE::CpuData, __CPU_Private_Data::Dropped, _OPEN_INSTANCE::DumpEvent, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::Filter, JIT_BPF_Filter::Function, PacketHeader::header, _OPEN_INSTANCE::MachineLock, _OPEN_INSTANCE::MaxDumpPacks, _OPEN_INSTANCE::mem_ex, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, MODE_MON, MODE_STAT, _OPEN_INSTANCE::Nbytes, NCpu, _OPEN_INSTANCE::Npackets, _OPEN_INSTANCE::PacketPool, __CPU_Private_Data::Processing, _OPEN_INSTANCE::ReadEvent, __CPU_Private_Data::Received, RESERVED, _OPEN_INSTANCE::Size, _OPEN_INSTANCE::SkipProcessing, PacketHeader::SN, _OPEN_INSTANCE::tme, and _OPEN_INSTANCE::WriterSN.

Referenced by DriverEntry().

VOID NPF_TransferDataComplete IN NDIS_HANDLE    ProtocolBindingContext,
IN PNDIS_PACKET    Packet,
IN NDIS_STATUS    Status,
IN UINT    BytesTransferred
 

Ends the transfer of a packet.

Parameters:
ProtocolBindingContext Context of the function. Contains a pointer to the OPEN_INSTANCE structure associated with the current instance.
Packet Pointer to the NDIS_PACKET structure that received the packet data.
Status Status of the transfer operation.
BytesTransferred Amount of bytes transferred.
Callback function associated with the NdisTransferData() NDIS function. It is invoked by NDIS when the NIC driver has finished the transfer of a packet from the NIC driver memory to the NPF circular buffer.

Definition at line 807 of file Read.c.

References __CPU_Private_Data::Accepted, bpf_hdr::bh_caplen, bpf_hdr::bh_tstamp, _OPEN_INSTANCE::CpuData, _OPEN_INSTANCE::DumpEvent, PacketHeader::header, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, _OPEN_INSTANCE::ReadEvent, RESERVED, _OPEN_INSTANCE::Size, PacketHeader::SN, __CPU_Private_Data::TransferMdl1, __CPU_Private_Data::TransferMdl2, and _OPEN_INSTANCE::WriterSN.

Referenced by DriverEntry().


Variable Documentation

struct time_conv G_Start_Time
 

Global start time. Used as an absolute reference for timestamp conversion.

Definition at line 33 of file Read.c.

ULONG NCpu
 

Definition at line 35 of file Read.c.

Referenced by DriverEntry(), NPF_IoControl(), NPF_Read(), and NPF_tap().


documentation. Copyright (c)2002-2003 Politecnico di Torino.
2005 translated by Telebusiness,Inc.
 All rights reserved.