Main Page Modules Data Structures File List Data Fields Globals Related Pages

# Read.c File Reference

`#include <stdarg.h>`
`#include "ntddk.h"`
`#include <ntiologc.h>`
`#include <ndis.h>`
`#include "debug.h"`
`#include "packet.h"`
`#include "win_bpf.h"`
`#include "tme.h"`
`#include "time_calls.h"`

Go to the source code of this file.

## Functions
NTSTATUS | NPF_Read (IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
| Function that serves the user's reads.
NDIS_STATUS | NPF_tap (IN NDIS_HANDLE ProtocolBindingContext, IN NDIS_HANDLE MacReceiveContext, IN PVOID HeaderBuffer, IN UINT HeaderBufferSize, IN PVOID LookaheadBuffer, IN UINT LookaheadBufferSize, IN UINT PacketSize)
| Callback invoked by NDIS when a packet arrives from the network.
VOID | NPF_TransferDataComplete (IN NDIS_HANDLE ProtocolBindingContext, IN PNDIS_PACKET pPacket, IN NDIS_STATUS Status, IN UINT BytesTransfered)
| Ends the transfer of a packet.
VOID | NPF_ReceiveComplete (IN NDIS_HANDLE ProtocolBindingContext)
| Callback function that signals the end of a packet reception.
## Variables
time_conv | G_Start_Time
| Global start time. Used as an absolute reference for timestamp conversion.
ULONG | NCpu

## Function Documentation

NTSTATUS NPF_Read | ( | IN PDEVICE_OBJECT | DeviceObject,
|  | IN PIRP | Irp
| ) |

  | Function that serves the user's reads. Parameters:
  DeviceObject | Pointer to the device used by the user.
  Irp | Pointer to the IRP containing the user request.
Returns: The status of the operation. See ntstatus.h in the DDK. This function is called by the OS in consequence of user ReadFile() call. It moves the data present in the kernel buffer to the user buffer associated with Irp. First of all, NPF_Read checks the amount of data in kernel buffer associated with current NPF instance. If the instance is in capture mode and the buffer contains more than OPEN_INSTANCE::MinToCopy bytes, NPF_Read moves the data in the user buffer and returns immediatly. In this way, the read performed by the user is not blocking. If the buffer contains less than MinToCopy bytes, the application's request isn't satisfied immediately, but it's blocked until at least MinToCopy bytes arrive from the net or the timeout on this read expires. The timeout is kept in the OPEN_INSTANCE::TimeOut field. If the instance is in statistical mode or in dump mode, the application's request is blocked until the timeout kept in OPEN_INSTANCE::TimeOut expires. Definition at line 37 of file Read.c. References bpf_hdr::bh_caplen, bpf_hdr::bh_datalen, bpf_hdr::bh_hdrlen, bpf_hdr::bh_tstamp, _OPEN_INSTANCE::Bound, _OPEN_INSTANCE::CountersLock, _OPEN_INSTANCE::CpuData, _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpOffset, EXIT_FAILURE, EXIT_SUCCESS, __CPU_Private_Data::Free, PacketHeader::header, IMMEDIATE, _OPEN_INSTANCE::MachineLock, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, MODE_MON, MODE_STAT, _OPEN_INSTANCE::Nbytes, NCpu, _OPEN_INSTANCE::Npackets, Packet_WORDALIGN, _OPEN_INSTANCE::ReaderSN, _OPEN_INSTANCE::ReadEvent, _OPEN_INSTANCE::Size, PacketHeader::SN, _OPEN_INSTANCE::TimeOut, and _OPEN_INSTANCE::tme. Referenced by DriverEntry().

VOID NPF_ReceiveComplete | ( | IN NDIS_HANDLE | ProtocolBindingContext | ) |

  | Callback function that signals the end of a packet reception. Parameters:
  ProtocolBindingContext | Context of the function. Contains a pointer to the OPEN_INSTANCE structure associated with the current instance.
does nothing in NPF Definition at line 876 of file Read.c. Referenced by DriverEntry().

NDIS_STATUS NPF_tap | ( | IN NDIS_HANDLE | ProtocolBindingContext,
|  | IN NDIS_HANDLE | MacReceiveContext,
|  | IN PVOID | HeaderBuffer,
|  | IN UINT | HeaderBufferSize,
|  | IN PVOID | LookAheadBuffer,
|  | IN UINT | LookaheadBufferSize,
|  | IN UINT | PacketSize
| ) |

  | Callback invoked by NDIS when a packet arrives from the network. Parameters:
  ProtocolBindingContext | Context of the function. Points to a OPEN_INSTANCE structure that identifies the NPF instance to which the packets are destined.
  MacReceiveContext | Handle that identifies the underlying NIC driver that generated the request. This value must be used when the packet is transferred from the NIC driver with NdisTransferData().
  HeaderBuffer | Pointer to the buffer in the NIC driver memory that contains the header of the packet.
  HeaderBufferSize | Size in bytes of the header.
  LookAheadBuffer | Pointer to the buffer in the NIC driver's memory that contains the incoming packet's data available to NPF. This value does not necessarily coincide with the actual size of the packet, since only a portion can be available at this time. The remaining portion can be obtained with the NdisTransferData() NDIS function.
  LookaheadBufferSize | Size in bytes of the lookahead buffer.
  PacketSize | Total size of the incoming packet, excluded the header.
Returns: The status of the operation. See ntstatus.h in the DDK. NPF_tap() is called by the underlying NIC for every incoming packet. It is the most important and one of the most complex functions of NPF: it executes the filter, runs the statistical engine (if the instance is in statistical mode), gathers the timestamp, moves the packet in the buffer. NPF_tap() is the only function, along with the filtering ones, that is executed for every incoming packet, therefore it is carefully optimized. Definition at line 297 of file Read.c. References __CPU_Private_Data::Accepted, _OPEN_INSTANCE::AdapterHandle, bpf_hdr::bh_caplen, bpf_hdr::bh_datalen, bpf_hdr::bh_hdrlen, bpf_hdr::bh_tstamp, bpf_filter(), bpf_filter_with_2_buffers(), _OPEN_INSTANCE::bpfprogram, _OPEN_INSTANCE::CountersLock, _OPEN_INSTANCE::CpuData, __CPU_Private_Data::Dropped, _OPEN_INSTANCE::DumpEvent, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::Filter, JIT_BPF_Filter::Function, PacketHeader::header, _OPEN_INSTANCE::MachineLock, _OPEN_INSTANCE::MaxDumpPacks, _OPEN_INSTANCE::mem_ex, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, MODE_MON, MODE_STAT, _OPEN_INSTANCE::Nbytes, NCpu, _OPEN_INSTANCE::Npackets, _OPEN_INSTANCE::PacketPool, __CPU_Private_Data::Processing, _OPEN_INSTANCE::ReadEvent, __CPU_Private_Data::Received, RESERVED, _OPEN_INSTANCE::Size, _OPEN_INSTANCE::SkipProcessing, PacketHeader::SN, _OPEN_INSTANCE::tme, and _OPEN_INSTANCE::WriterSN. Referenced by DriverEntry().

VOID NPF_TransferDataComplete | ( | IN NDIS_HANDLE | ProtocolBindingContext,
|  | IN PNDIS_PACKET | Packet,
|  | IN NDIS_STATUS | Status,
|  | IN UINT | BytesTransferred
| ) |

  | Ends the transfer of a packet. Parameters:
  ProtocolBindingContext | Context of the function. Contains a pointer to the OPEN_INSTANCE structure associated with the current instance.
  Packet | Pointer to the NDIS_PACKET structure that received the packet data.
  Status | Status of the transfer operation.
  BytesTransferred | Amount of bytes transferred.
Callback function associated with the NdisTransferData() NDIS function. It is invoked by NDIS when the NIC driver has finished the transfer of a packet from the NIC driver memory to the NPF circular buffer. Definition at line 807 of file Read.c. References __CPU_Private_Data::Accepted, bpf_hdr::bh_caplen, bpf_hdr::bh_tstamp, _OPEN_INSTANCE::CpuData, _OPEN_INSTANCE::DumpEvent, PacketHeader::header, _OPEN_INSTANCE::MinToCopy, _OPEN_INSTANCE::mode, MODE_DUMP, _OPEN_INSTANCE::ReadEvent, RESERVED, _OPEN_INSTANCE::Size, PacketHeader::SN, __CPU_Private_Data::TransferMdl1, __CPU_Private_Data::TransferMdl2, and _OPEN_INSTANCE::WriterSN. Referenced by DriverEntry().

## Variable Documentation

struct time_conv G_Start_Time

| Global start time. Used as an absolute reference for timestamp conversion. Definition at line 33 of file Read.c.

ULONG NCpu

| Definition at line 35 of file Read.c. Referenced by DriverEntry(), NPF_IoControl(), NPF_Read(), and NPF_tap().

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.