Windows NT Kernel-Mode Device Drivers:
A Practical Hands-On Approach.

COURSE OUTLINE

Chapter 1: Getting Started: A Simple Device Driver: Async.sys

§ DDK Installation

§ Building the DDK Samples

§ 1^st Attempt to Start Async.sys - Problems

§ By Hand Editing of the NT Registry for Async.sys

§ Start NtIce.sys

§ NuMega’s Symbol Loader

§ Basics of SoftIce Debugging

§ SoftIce Execution Breakpoints in Async.sys

§ Single Step-Execution with SoftIce

§ Async.sys DriverEntry()

§ RtlQueryRegistryValues()

§ SoftIce Windows: Command, Code, Locals, Data

§ Successful start of Async.sys

§ Stopping a device driver

§ Additional Hands-On Exercises

Chapter 2: Async.sys Structure and Calls – Basic Elements

§ DriverEntry() – responsibilities & requirements

§ IoCreateDevice() / IoDeleteDevice()

§ The DEVICE_OBJECT structure.

§ The Registry - More

§ Device Extension

§ Interrupt Request Levels (IRQL’s)

§ KeRaiseIrql()

§ KeLowerIrql()

§ The Kernel-Mode Support Routines (Runtime Library)

§ Driver Initialization and Unload

§ Interrupt Request Packets (IRP)

§ Synchronization

§ Memory

§ Direct Memory Access (DMA)

§ Programmed (Parallel) Input/Output (PIO)

§ Driver-Managed Queues

§ Driver-dedicated system threads and system worker threads

§ Strings

§ Data Conversions

§ Access to and access rights on Driver-Managed Objects

§ Error Handling

§ Basic Elements in Async.sys – Back to SoftIce

§ The UNICODE_STRING structure.

§ RtlInitUnicodeString()

§ The DRIVER_OBJECT structure.

§ DriverObject->HardwareDatabase

§ ->MajorFunction[] array

§ Conversion of Kernel error codes to User Mode error codes

§ SoftIce built-in functions

§ The Current Interrupt Request Level (IRQL)

§ Symbolic Links – One for Async.sys

§ IoCreateSymbolicLink()

§ IoDeleteSymbolicLink()

§ Adding source files to the Build of a DDK device driver

§ Opening a Device From User Mode – Win32’s CreateFile() – Debugging Exercises

§ Thread Context in which Device drivers are called

§ SoftIce Address Contexts

§ Manipulation of SoftIce breakpoints – conditional breakpoints Exercises

§ The SoftIce Stack command

§ Dispatch Routines

§ Basic Dispatch Routine Functionality

§ How to Complete an IRP in a Dispatch Routine

§ Dispatch Create and Dispatch Close Functionality

§ Basic DispatchCreateClose Routines

§ Points to Consider in Implementing DispatchCreateClose

§ Additional Hands-On Exercise: AsyncDispatch()

Chapter 3: Locating Hardware

§ Registry Paths Supplied to NT Drivers

§ Support routines that NT drivers can call

§ RegistryPath, DriverName, and Device Object Names

§ Calling IoGetConfigurationInformation to Determine Device Object Names

§ Getting Device Hardware Configuration Information

§ NT Detected Hardware Information

§ NT Undetected Hardware Information

§ Calling IoQueryDeviceDescription

§ Supplying a ConfigCallback Routine

§ Making Calls to IoQueryDeviceDescription

§ Processing Configuration Information in ConfigCallback

§ Calling HalGetBusData or HalGetBusDataByOffset

§ Using the RegistryPath Parameters

§ Exercise: IoGetConfigurationInformation()

§ A few Kernel-Mode Support Routines

§ A Comment on adding source files to the Build of a DDK device driver

§ A Comment on C versus C++ NT Device Driver writing

§ Exercise: NT Detected Hardware

§ Exercise: NT Undetected Hardware

§ Exercise: More On NT Detected Hardware

§ Exercise: More On NT Undetected Hardware

Chapter 4: Reading From A Device

§ Exercise: User-Mode ReadFile()

§ Exercise: A relationship between User-Mode CreateFile(), ReadFile() and Kernel-Mode IoCreateDevice()

§ DispatchRoutine() handling of IRP_MJ_READ requests.

§ Buffered I/O vs. Direct I/O

§ Using Buffered I/O - Operating System Considerations

§ Using Direct I/O - Operating System Considerations

§ Using Neither Direct nor Buffered I/O

§ Handling Asynchronous Transfer Requests

§ DispatchRead and/or DispatchWrite Functionality

§ DispatchReadWrite Using Buffered I/O

§ DispatchReadWrite Using Direct I/O

§ Points to Consider in Implementing DispatchReadWrite

§ Exercise: IRP_MJ_READ handling in Async.sys

§ Exercise: Synchronous, Buffered I/O, User Mode Read from a Device

§ Exercise: Asynchronous, Buffered I/O, User Mode Read from a Device

§ Optional Exercise: Synchronous, Direct I/O, User Mode Read from a Device

§ Optional Exercise: Asynchronous, Direct I/O, User Mode Read from a Device

Chapter 5: Allocating and Releasing Hardware

§ Support Routines

§ HardwareDatabase and the System DeviceMap

§ On the call to IoQueryDeviceDescription()

§ Claiming Hardware Resources

§ Calling IoReportResourceUsage()

§ Handling Resource Conflicts

§ Releasing Resources

§ Calling IoAssignResources() or HalAssignSlotResource()

§ Handling Resource Conflicts

§ Releasing Resources

§ Exercise: Allocating Hardware

§ Exercise: Genport.sys, Port I/O using IOCTL’s

§ Exercise: List All IoQueryDeviceDescription()–known Ports

Chapter 6: Interrupt Handling & Deferred Procedure Calls. Part 1: Basics

§ Always Pre-emptible and Always Interruptible

§ Device Interrupts

§ Interrupt Handling: Other Standard NT Driver Routines

§ Support Routines that Manipulate NT Objects

§ Storage for NT Objects

§ Initializing Driver-specific Device Objects and Device Extensions

§ Interrupt Objects

§ Getting a System-assigned Interrupt Vector, DIRQL, and Processor Mask

§ Registering an ISR

§ DPC Objects

§ Registering and Queuing a DpcForIsr Routine

§ ISR and DpcForIsr

§ Registering and Queuing a CustomDpc Routine

§ Exercise: Installing a Interrupt Handler

§ Exercise: In-Software Emulation of Hardware

Chapter 7: Interrupt Handling and Deferred Procedure Calls. Part II: Complications

§ Interrupt Service Routine Requirements

§ ISR Performance

§ Setting Up an ISR

§ Basic ISR Functionality

§ ISR Functionality for Overlapped I/O Operations

§ DpcForIsr and CustomDpc Routine Requirements

§ DpcForIsr versus CustomDpc Routines

§ Basic DpcForIsr Requirements

§ Basic CustomDpc Routine Requirements

§ Additional Required Driver Routines

§ Setting Up DpcForIsr and CustomDpc Routines

§ DpcForIsr and CustomDpc Functionality

§ Using Buffered I/O and Satisfying Device Control IRPs

§ Using Direct I/O

§ Points to Consider in Implementing a DpcForIsr or CustomDpc Routine

§ SynchCritSection Routine Requirements

§ Using a SynchCritSection Routine

§ Running a SynchCritSection Routine

§ SynchCritSection Routine Performance Requirements

§ SynchCritSection Routine Functionality

§ Programming the Device for an I/O Operation

§ Maintaining State About Interrupt-Driven I/O Operations

§ Exercise: A Simple Input Device

Chapter 8: Threads, Synchronization, and Spinlocks

§ Multiprocessor-safe

§ Managing Hardware Priorities

§ System Worker Threads

§ Exercise: Using a System Worker Thread

§ Device Dedicated System Threads

§ Exercise: Creating a Dedicated System Thread

§ Using Spin Locks

§ Providing Storage for Spin Locks and Protected Data

§ Initializing Spin Locks

§ Calling Support Routines That Use Spin Locks

§ Releasing Spin Locks Promptly

§ Preventing Errors or Deadlocks While Using Spin Locks

§ Exercise: Access Synchronization Using One Spin Lock

§ Kernel Dispatcher Objects

§ Dispatcher Objects State and Thread Priorities

§ Waiting on Dispatcher Objects in NT Drivers

§ Timer Objects

§ Event Objects

§ Semaphore Objects

§ Mutex Objects

§ Exercise: Thread-Start Synchronization Using a Notification Event

Chapter 9: Interlocked Queues, Pending Irps, IRP_MJ_CLEANUP and the Cancel Routine

§ Device Queue Objects and Interlocked Queues

§ Setting up a Device Queue Object and Queueing IRPs

§ Setting up an Interlocked Queue and Queueing IRPs

§ Requirements for Using Interlocked Queues or Device Queues

§ Storage Requirements for Driver-Managed Queues

§ Setting Up Driver-Managed Queues

§ Queueing IRPs in Driver-Managed Queues

§ Managing Interlocked Queues with a Driver-Created Thread

§ Managing Supplemental Device Queues

§ Managing Supplemental Device Queues Across Driver Routines

§ Pending IRPs

§ Exercise: Asynchronous Read and File Close Operations to a Device. Part I : the Problem

§ Commonly Implemented Dispatch Routines

§ Destruction of File Objects

§ When to Complete an IRP in the Dispatch Routine

§ DispatchCleanup Functionality

§ Exercise: Asynchronous Read and File Close Operations to a Device. Part II : An Interlocked Queue

§ Cancel Routines

§ Cancel Routine Requirements

§ Cancel Routines in NT Drivers

§ Cancelable IRPs in Higher-Level Drivers without Cancel Routines

§ Handling Cancelable IRPs

§ Handling Cancelable IRPs in Driver Routines That Pass IRPs On

§ Handling Cancelable IRPs In Driver Routines That Process Requests

§ Using the System Cancel Spin Lock

§ Cancel Routine Functionality

§ Cancel Routines in Drivers with StartIo Routines

§ Cancel Routines in Drivers without StartIo Routines

§ Points to Consider In Handling Cancelable IRPs

§ Exercise: Asynchronous Read and Cancellable IRP’s

§ Exercise: Concurrent Read / Write Operations to a Device: Pending IRP’s in Read and Write Interlocked Queues

Chapter 10: StartIo and Queue Management Routines

§ StartIo Routine

§ Queueing IRPs

§ StartIo Routines in NT Drivers

§ Internal Queues for IRPs in NT Drivers

§ Internal Queues With Startio Routines in NT Drivers

§ Internal Queues and Driver Threads

§ StartIo Routine Requirements

§ StartIo Routines in NT Drivers

§ StartIo Routine Functionality

§ Device Driver's StartIo Routine Using Buffered I/O

§ Device Driver's StartIo Routine Using Direct I/O

§ Handling Device Control Requests in StartIo

§ Programming the Device for I/O Operations

§ StartIo Routines in Higher-Level NT Drivers

§ Points to Consider in Implementing StartIo

§ Device Queues with a StartIo Routine

§ Using Supplemental Device Queues with a StartIo Routine

§ Managing Supplemental Device Queues in StartIo

Chapter 11: Driver Layering I – IRP Processing in Layered Drivers

§ IRPs and Driver-specific I/O Stack Locations

§ Opening an NT File Object

§ Processing IRPs in Layered NT Drivers

§ Points to Consider about Processing IRPs

§ Device Drivers' Staged IRP Processing

§ Calling IoGetCurrentIrpStackLocation

§ Calling IoMarkIrpPending and IoStartPacket

§ Calling IoRequestDpc from the Driver's ISR

§ Calling IoStartNextPacket and IoCompleteRequest

§ Setting the I/O Status Block in an IRP

§ Supplying a PriorityBoost in Calls to IoCompleteRequest

§ Effect of Calling IoCompleteRequest

§ Intermediate Drivers' Staged IRP Processing

§ Allocating IRPs

§ Calling IoSetCompletionRoutine and IoCallDriver

§ Processing IRPs in the Driver's IoCompletion Routine

§ When to Complete an IRP in the Dispatch Routine

§ How to Pass IRPs with Valid Parameters on from a Dispatch Routine

§ DispatchReadWrite in Higher-Level Drivers

Chapter 12: Driver Layering II – Installing a Layered Driver

§ NT Components and NT Drivers

§ Creating a Device Object and Device Extension

§ Initializing Driver-specific Device Objects and Device Extensions

§ Naming Device Objects

§ DispatchCreate and DispatchClose Functionality

§ Points to Consider in Implementing DispatchCreateClose

§ Releasing Driver-Allocated Resources

§ DriverEntry's Additional Responsibilites

§ Higher-Level Driver's Initialization

§ Exercise: Transparent Layering over a Device Driver.

Chapter 13: Driver Layering III - Complications

§ Allocating IRPs for Lower-Level Drivers

§ StartIo Routines in Higher-Level NT Drivers

§ Cancel Routines in NT Drivers

§ Cancelable IRPs in Higher-Level Drivers without Cancel

§ IoCompletion Routines

§ Using IoCompletion Routines

§ Setting Up an IoCompletion Routine

§ Calling IoSetCompletionRoutine

§ IoCompletion Routine and Allocated IRPs for Lower Drivers