270 likes | 746 Views
WDM 드라이버의 기본 구조. What is WDM ? What are Device Objects and Device Stacks ? Something about Kernel-Mode Driver Components. Contents. Types of Windows Drivers. Highest-level drivers always depend on support from underlying lower-level drivers
E N D
WDM 드라이버의 기본 구조 What is WDM? What are Device Objects and Device Stacks? Something about Kernel-Mode Driver Components
Types of Windows Drivers • Highest-level drivers always depend on support from underlying lower-level drivers • Intermediate drivers depend on support from underlying lower-level drivers. • Function/filter driver • Lowest-level drivers control an I/O bus to which peripheral devices are connected.
Design Goal for Drivers • Portable • Configurable • Always pre-emptible and always interruptible • Multiprocessor-safe • Object-based • Packet-driven I/O with reusable IRPs • Capable of supporting asynchronous I/O
WDM(Windows Driver Model) • 모든 Windows 운영체제에서 동작하는 드라이버를 개발하기 위한 드라이버 개발 모델. • Include wdm.h • 세가지 타입의 드라이버로 구분됨(bus/function/filter) • 디바이스 오브젝트를 생성. • PnP지원 • Power Management(전원관리) 지원 • WMI 지원. • WDM 을 따르지 않는 드라이버(Non-WDM Driver)도 존재함. • WDM은 오랜시간동안 개발되어 왔기 때문에, 버전 별 차이가 있다. 이식성을 생각한다면 가장 낮은 버전에 기준을 두고 개발해야 함.
WDM 드라이버 타입 • Bus Driver • Enumerate the device on its bus • Respond to Plug and Play IRPs and power management IRPs • Multiplex access to the bus • Generically administer the devices on its bus • Filter Driver • Add value to or modify the behavior of a device • Optional • Function Driver • Handles reads and writes to the device and manage device power policy
Device Object • OS represents devices by device object • One or more device object are associated with each device (n:1) • Software-only driver still must a device object to represent the target of its operations • System passes an IRP data structure to the driver for the top device object in the device stack
Types of Device Object • Physical Device Object • Represents a device on a bus to a bus driver • Function Device Object • Represents a device to a function driver • Filter Device Object • Represents a device to a filter driver • Each device objects are all of the type DEVICE_OBJECT, but are used differently and can have different device extensions
Device Stack • 각 PDO들은 하위(부모) 디바이스에서 생성해줌. • PDO와 FDO는 반드시 존재함. • Device Stack 에서 PDO하단에는 디바이스 오브젝트가 위치할 수 없음.
Creating a Device Object • Device Extension is a system-allocated storage area that the driver can use for device-specific storage • Device Type represented by the device object • Characteristic indicate the device characteristics for the device • Exclusive indicate the driver services an exclusive device • WDM drivers must set FALSE • Driver Object point to their driver object in their DriverEntry routine • Device Name is an optional pointer to a null-terminated Unicode String • Only with non-WDM/Bus drivers
Named Device Objects • Device object can be named or unnamed. • 유저모드 어플리케이션이 이름으로 연산 대상을 정하면, 오브젝트 매니저가 이름을 확인하고 I/O 목적지를 정함. (Communication between driver and app) • WDM drivers do not in general require MS-DOS device name but interface
NT Device Name • NT device name은 \Device\DeviceName형식. • WDM Driver • Bus driver specifies the FILE_AUTOGENERATED_DEVICE_NAME device characteristic when it creates device object. • FDO, Filter DO are not named. • Non-WDM Driver • Must explicitly specify a name. If not, cant accessible from user mode
Device Extensions ex • Driver-defined structure. • Maintain device state information • Provide storage for any kernel-defined objects or other system resources used by the driver • Hold any data the driver must have resident and in system space to carry out its I/O operations
Device Object properties • Type • Ntddk.h/wdm.h에 상수로 define • Characteristics • 각 디바이스 오브젝트는 1개 이상의 속성을 가질수 있음. • FILE_DEVICE_SECURE_OPEN • In the Registry • WDM: can be set each device or a whole device setup class • Non-WDM: can be set for a named device object’s device setup class
Controlling Device Access • Can be specified when the device object is created, or set in the registry • WDM: when create device object, PnP manager determines a security descriptor for the device • Set by Registry VS default security descriptor • WDM(Bus Driver): • Must provide security descriptor for PDO opened in raw mode. • Non-WDM: • Must specify default security descriptor and class GUID for named device object.
Standard Driver Routines • Required • DriverEntry: initialize the driver and driver its object • AddDevice: initialize devices and creates device objects • Dispatch Routine: receive and process IRPs • Unload: release system resources acquired by driver • Optional • Reinitialize: DriverEntry가 초기화를 마무리 못했다면, 마무리 • StartIo: start I/O on a physical device • Interrupt Service Routine: save device state when interrupted • SynchCritSection: synchronizes access to driver data • IoCompletion: completes driver’s processing of an IRP • Cancel: cancel driver’s processing of an IRP • ... And more ...
Standard driver routine required • Must have DriverEntry which initialize driver-wide data structures and resources. • Must have at least one dispatch routine • WDM driver must have an Unload routine. • WDM driver must have AddDevice routine. • Can have StartIo routine • 기능에 따라 다른 종류의 standard routine을 포함.
Driver Object • I/O manager creates a driver object for each driver • Driver object contains storage for entry points to many of a driver’s standard routines. • DriverEntry routine supplies the address of the driver’s driver object
Entry Points in Driver Objects • AddDevice routine at DriverObject->DriverExtension->AddDevice • If driver manages its own queue of IRPs, specify StartIo routine • Can be loaded/replaced dynamically, specify Unload routine ex
Required Dispatch Routines ex • DispatchPnP: IRP_MJ_PNP • Request PnP device recognition, hardware configuration, resource allocation • DispatchPower: IRP_MJ_ROUTINE • Request pertaining to the power state of either their device or the system • DispatchCreate: IRP_MJ_CREATE • DispatchClose: IRP_MJ_CLOSE • Last handle of the file object that was associated the target device object has been closed and released. • DispatchRead: IRP_MJ_READ • Transfer data from the underlying physical device to the system. • DispatchWrite: IRP_MJ_WRITE • Transfer data from the system to the underlying physical device • DispatchDeviceControl: IRP_MJ_DEVICE_CONTROL • DispatchInternalDeviceControl: IRP_MJ_INTERNAL_DEVICE_CONTROL • DispatchSystemControl: IRP_MJ_SYSTEM_CONTROL • Used to specify WMI requests to drivers
Unload routine environment • PnP manager calls Unload routine if driver has no more device objects after driver handles an IRP_MN_REMOVE_DEVICE request • Start of unloading sequence, driver object and its device objects as “unload pending”. • While “unload pending”, no additional driver attach and no IRPs to the driver
Unload Routine • PnP Driver: • In general, unloading process is a synchronous • If driver allocated driver-wide resources, it must de-allocate in Unload routine unless it has already done so. • Non-PnP Driver: • Must release resources, delete device objects, and detach from the device stack in Unload routine.If not, ISR might be calld to handle a device interrupt while the Unload routine is releasing resources. • After disabling interrupt, file system/legacy driver release resources and objects.