WDM 드라이버의 기본 구조

What is WDM?What are Device Objects and

Device Stacks?Something about

Kernel-Mode Driver Components

Contents

Win

dows

드라이버 소개

•Types •Design goal

Win

dows

Driver M

odel

•What is WDM?•Types

Devic

e Objects

and

Devic

e Stacks

•What is De-vice Ob-ject?

•De-vice Ob-ject Type

•Creat-ing De-vice Ob-ject

•Named de-vice object

•NT de-vice name

•De-vice ex-ten-sion

•Prop-erties

•De-vice ac-cess 제어

Driver Co

mponents

•Standard Driver Rou-tine•필수 루틴•Driver Ob-ject•Driver Ob-ject의 En-try Point•필수 Dis-patch Rou-tine•Un-load rou-tine

Types of Windows Drivers

• Highest-level drivers al-ways depend on support from underlying lower-level drivers

• Intermediate drivers de-pend on support from un-derlying lower-level driv-ers.– Function/filter driver

• Lowest-level drivers con-trol an I/O bus to which peripheral devices are connected.

Design Goal for Drivers

• Portable• Configurable• Always pre-emptible and always inter-

ruptible • Multiprocessor-safe• Object-based • Packet-driven I/O with reusable IRPs • Capable of supporting asynchronous I/O

QA

WDM(Windows Driver Model)

• 모든 Windows 운영체제에서 동작하는 드라이버를 개발하기 위한 드라이버 개발 모델 .– Include wdm.h– 세가지 타입의 드라이버로 구분됨 (bus/function/filter)– 디바이스 오브젝트를 생성 .– PnP 지원– Power Management( 전원관리 ) 지원– WMI 지원 .

• WDM 을 따르지 않는 드라이버 (Non-WDM Driver) 도 존재함 .• WDM 은 오랜시간동안 개발되어 왔기 때문에 , 버전 별 차이가

있다 . 이식성을 생각한다면 가장 낮은 버전에 기준을 두고 개발해야 함 .

WDM 드라이버 타입• Bus Driver

– Enumerate the device on its bus– Respond to Plug and Play IRPs and power manage-

ment IRPs– Multiplex access to the bus– Generically administer the devices on its bus

• Filter Driver– Add value to or modify the behavior of a device– Optional

• Function Driver– Handles reads and writes to the device and manage

device power policy

WDM Driver Layer Example

QA

Device Object

• OS represents devices by device object• One or more device object are associ-

ated with each device (n:1)• Software-only driver still must a device

object to represent the target of its op-erations

• System passes an IRP data structure to the driver for the top device object in the device stack

Types of Device Object

• Physical Device Object– Represents a device on a bus to a bus driver

• Function Device Object– Represents a device to a function driver

• Filter Device Object– Represents a device to a filter driver

• Each device objects are all of the type DE-VICE_OBJECT, but are used differently and can have different device extensions

Device Stack

• 각 PDO 들은 하위 ( 부모 ) 디바이스에서 생성해줌 .

• PDO 와 FDO는 반드시 존재함 .

• Device Stack 에서 PDO하단에는 디바이스 오브젝트가 위치할 수 없음 .

Creating a Device Object• Device Extension is a system-allo-

cated storage area that the driver can use for device-specific storage

• Device Type represented by the device object

• Characteristic indicate the device characteristics for the device

• Exclusive indicate the driver ser-vices an exclusive device– WDM drivers must set FALSE

• Driver Object point to their driver object in their DriverEntry routine

• Device Name is an optional pointer to a null-terminated Unicode String– Only with non-WDM/Bus drivers

Named Device Objects

• Device object can be named or un-named.

• 유저모드 어플리케이션이 이름으로 연산 대상을 정하면 , 오브젝트 매니저가 이름을 확인하고 I/O 목적지를 정함 . (Communi-cation between driver and app)

• WDM drivers do not in general re-quire MS-DOS device name but inter-face

NT Device Name

• NT device name 은 \Device\DeviceName 형식 .

• WDM Driver– Bus driver specifies the

FILE_AUTOGENERATED_DEVICE_NAME device characteristic when it creates device object.

– FDO, Filter DO are not named.

• Non-WDM Driver– Must explicitly specify a name.

If not, cant accessible from user mode

Device Extensions

• Driver-defined structure.• Maintain device state informa-

tion• Provide storage for any kernel-

defined objects or other system resources used by the driver

• Hold any data the driver must have resident and in system space to carry out its I/O opera-tions

ex

Device Object properties

• Type– Ntddk.h/wdm.h 에 상수로 define

• Characteristics– 각 디바이스 오브젝트는 1 개 이상의 속성을 가질수 있음 .– FILE_DEVICE_SECURE_OPEN

• In the Registry– WDM: can be set each device or a whole de-

vice setup class– Non-WDM: can be set for a named device ob-

ject’s device setup class

Controlling Device Access

• Can be specified when the device object is cre-ated, or set in the registry

• WDM: when create device object, PnP manager determines a security descriptor for the device– Set by Registry VS default security descriptor

• WDM(Bus Driver):– Must provide security descriptor for PDO opened in

raw mode.

• Non-WDM:– Must specify default security descriptor and class

GUID for named device object.

QA

Standard Driver Routines

• Required– DriverEntry: initialize the driver and driver its object– AddDevice: initialize devices and creates device objects– Dispatch Routine: receive and process IRPs– Unload: release system resources acquired by driver

• Optional– Reinitialize: DriverEntry 가 초기화를 마무리 못했다면 , 마무리– StartIo: start I/O on a physical device– Interrupt Service Routine: save device state when interrupted– SynchCritSection: synchronizes access to driver data– IoCompletion: completes driver’s processing of an IRP– Cancel: cancel driver’s processing of an IRP– ... And more ...

Standard driver routine required

• Must have DriverEntry which initialize driver-wide data structures and resources.

• Must have at least one dispatch routine• WDM driver must have an Unload routine.• WDM driver must have AddDevice routine.• Can have StartIo routine• 기능에 따라 다른 종류의 standard routine 을 포함 .

Driver Object

• I/O manager creates a driver object for each driver

• Driver object contains storage for en-try points to many of a driver’s stan-dard routines.

• DriverEntry routine supplies the ad-dress of the driver’s driver object

Entry Points in Driver Objects

• AddDevice routine at DriverObject->DriverEx-tension->AddDevice

• If driver manages its own queue of IRPs, specify StartIo routine

• Can be loaded/replaced dynamically, specify Un-load routine

ex

Required Dispatch Routines

• DispatchPnP: IRP_MJ_PNP– Request PnP device recognition, hardware configuration, resource allocation

• DispatchPower: IRP_MJ_ROUTINE– Request pertaining to the power state of either their device or the system

• DispatchCreate: IRP_MJ_CREATE

• DispatchClose: IRP_MJ_CLOSE– Last handle of the file object that was associated the target device object has been

closed and released.

• DispatchRead: IRP_MJ_READ– Transfer data from the underlying physical device to the system.

• DispatchWrite: IRP_MJ_WRITE– Transfer data from the system to the underlying physical device

• DispatchDeviceControl: IRP_MJ_DEVICE_CONTROL

• DispatchInternalDeviceControl: IRP_MJ_INTERNAL_DEVICE_CONTROL

• DispatchSystemControl: IRP_MJ_SYSTEM_CONTROL– Used to specify WMI requests to drivers

ex

Unload routine environment

• PnP manager calls Unload routine if driver has no more device objects af-ter driver handles an IRP_MN_REMOVE_DEVICE request

• Start of unloading sequence, driver object and its device objects as “un-load pending”.

• While “unload pending”, no additional driver attach and no IRPs to the driver

Unload Routine

• PnP Driver: – In general, unloading process is a synchronous– If driver allocated driver-wide resources, it must de-

allocate in Unload routine unless it has already done so.

• Non-PnP Driver:– Must release resources, delete device objects, and

detach from the device stack in Unload routine.If not, ISR might be calld to handle a device inter-rupt while the Unload routine is releasing resources.

– After disabling interrupt, file system/legacy driver release resources and objects.

QA