WDM What is WDM What are Device Objects

WDM 드라이버의 기본 구조 What is WDM? What are Device Objects and Device Stacks? Something about Kernel-Mode Driver Components

• What is Device Object? • Device Object Type • Creating Device Object • Named device object • NT device name • Device extension • Properties • Device access 제어 Driver Components • What is WDM? • Types Device Objects and Device Stacks • Types • Design goal Windows Driver Model Windows 드라이버 소개 Contents • Standard Driver Routine • 필수 루틴 • Driver Object 의 Entry Point • 필수 Dispatch Routine • Unload routine

Types of Windows Drivers • Highest-level drivers always depend on support from underlying lower-level drivers • Intermediate drivers depend on support from underlying lower-level drivers. – Function/filter driver • Lowest-level drivers control an I/O bus to which peripheral devices are connected.

Design Goal for Drivers • Portable • Configurable • Always pre-emptible and always interruptible • Multiprocessor-safe • Object-based • Packet-driven I/O with reusable IRPs • Capable of supporting asynchronous I/O

QA

WDM 드라이버 타입 • Bus Driver – Enumerate the device on its bus – Respond to Plug and Play IRPs and power management IRPs – Multiplex access to the bus – Generically administer the devices on its bus • Filter Driver – Add value to or modify the behavior of a device – Optional • Function Driver – Handles reads and writes to the device and manage device power policy

WDM Driver Layer Example

QA

Device Object • OS represents devices by device object • One or more device object are associated with each device (n: 1) • Software-only driver still must a device object to represent the target of its operations • System passes an IRP data structure to the driver for the top device object in the device stack

Types of Device Object • Physical Device Object – Represents a device on a bus to a bus driver • Function Device Object – Represents a device to a function driver • Filter Device Object – Represents a device to a filter driver • Each device objects are all of the type DEVICE_OBJECT, DEVICE_OBJECT but are used differently and can have different device extensions

Creating a Device Object • Device Extension is a systemallocated storage area that the driver can use for device-specific storage • Device Type represented by the device object • Characteristic indicate the device characteristics for the device • Exclusive indicate the driver services an exclusive device – WDM drivers must set FALSE • Driver Object point to their driver object in their Driver. Entry routine • Device Name is an optional pointer to a null-terminated Unicode String – Only with non-WDM/Bus drivers

Named Device Objects • Device object can be named or unnamed. • 유저모드 어플리케이션이 이름으로 연산 대상을 정하면, 오브젝트 매니저가 이름을 확인하고 I/O 목적지를 정함. (Communication between driver and app) • WDM drivers do not in general require MS-DOS device name but interface

NT Device Name • NT device name은 Device. Name 형식. • WDM Driver – Bus driver specifies the FILE_AUTOGENERATED_DEVICE_NAME device characteristic when it creates device object. – FDO, Filter DO are not named. • Non-WDM Driver – Must explicitly specify a name. If not, cant accessible from user mode

ex Device Extensions • Driver-defined structure. • Maintain device state information • Provide storage for any kerneldefined objects or other system resources used by the driver • Hold any data the driver must have resident and in system space to carry out its I/O operations

Device Object properties • Type – Ntddk. h/wdm. h에 상수로 define • Characteristics – 각 디바이스 오브젝트는 1개 이상의 속성을 가질 수 있음. – FILE_DEVICE_SECURE_OPEN • In the Registry – WDM: can be set each device or a whole device setup class – Non-WDM: can be set for a named device object’s device setup class

Controlling Device Access • Can be specified when the device object is created, or set in the registry • WDM: when create device object, Pn. P manager determines a security descriptor for the device – Set by Registry VS default security descriptor • WDM(Bus Driver): – Must provide security descriptor for PDO opened in raw mode. • Non-WDM: – Must specify default security descriptor and class GUID for named device object.

QA

Standard Driver Routines • Required – – Driver. Entry: initialize the driver and driver its object Add. Device: initialize devices and creates device objects Dispatch Routine: receive and process IRPs Unload: release system resources acquired by driver – – – – Reinitialize: Driver. Entry가 초기화를 마무리 못했다면, 마무리 Start. Io: start I/O on a physical device Interrupt Service Routine: save device state when interrupted Synch. Crit. Section: synchronizes access to driver data Io. Completion: completes driver’s processing of an IRP Cancel: cancel driver’s processing of an IRP. . . And more. . . • Optional

Standard driver routine required • Must have Driver. Entry which initialize driver -wide data structures and resources. • Must have at least one dispatch routine • WDM driver must have an Unload routine. • WDM driver must have Add. Device routine. • Can have Start. Io routine • 기능에 따라 다른 종류의 standard routine을 포함.

Driver Object • I/O manager creates a driver object for each driver • Driver object contains storage for entry points to many of a driver’s standard routines. • Driver. Entry routine supplies the address of the driver’s driver object

Entry Points in Driver Objects • Add. Device routine at Driver. Object>Driver. Extension->Add. Device • If driver manages its own queue of IRPs, specify Start. Io routine • Can be loaded/replaced dynamically, specify Unload routine ex

Required Dispatch Routines ex • Dispatch. Pn. P: IRP_MJ_PNP • Dispatch. Power: IRP_MJ_ROUTINE • Dispatch. Create: IRP_MJ_CREATE • Dispatch. Close: IRP_MJ_CLOSE • Dispatch. Read: IRP_MJ_READ • Dispatch. Write: IRP_MJ_WRITE • Dispatch. Device. Control: IRP_MJ_DEVICE_CONTROL • Dispatch. Internal. Device. Control: IRP_MJ_INTERNAL_DEVICE_CONTROL • Dispatch. System. Control: IRP_MJ_SYSTEM_CONTROL – Request Pn. P device recognition, hardware configuration, resource allocation – Request pertaining to the power state of either their device or the system – Last handle of the file object that was associated the target device object has been closed and released. – Transfer data from the underlying physical device to the system. – Transfer data from the system to the underlying physical device – Used to specify WMI requests to drivers

Unload routine environment • Pn. P manager calls Unload routine if driver has no more device objects after driver handles an IRP_MN_REMOVE_DEVICE request • Start of unloading sequence, driver object and its device objects as “unload pending”. • While “unload pending”, no additional driver attach and no IRPs to the driver

Unload Routine • Pn. P Driver: – In general, unloading process is a synchronous – If driver allocated driver-wide resources, it must deallocate in Unload routine unless it has already done so. • Non-Pn. P Driver: – Must release resources, delete device objects, and detach from the device stack in Unload routine. If not, ISR might be calld to handle a device interrupt while the Unload routine is releasing resources. – After disabling interrupt, file system/legacy driver release resources and objects.

QA