How a device stack is made for a particular device?

Lets talk about a USB device,Soon i plug in a device, Function driver for the bus gets the notification,It informs the
PNP manager,and creates the PDO for the just plugged in device.

Now the pnp manager gathers the information from the PDO like HWID,Capabilities,Resources etc.
Based on the HWID pnp manager locate for the INF files for the best match and instaclls the rest of the driver and creates
the complete device stack.

Now my question is suppose the device stack consists of PDO,lower filter driver,Function driver and upper filter driver.
SO when PDO reports the HWIDS which HWID does it report? is it for lower filter driver or function driver or upper filter driver
or all of them at once?

For USB device, the hub driver (USBHUB.SYS) detects a new device plugged in some port. The hub driver assigns the USB address to the device, and reads the device descriptors, such as vendor and device ID, serial number, power requirements. Then it creates a new PDO for it and reports the child device change.

PNP manager queries the new PDO for the hardware ID string (which the hub driver creates from VID and PID), instance ID string (which is created from the serial number).

The PNP manager sees if there is already an entry in the registry for the device. If there is, it loads the device driver and calls its AddDevice function. AddDevice creates the FDO and attached it to the PDO. Then START_DEVICE is sent and the device is up and running.

If the entry doesn’t exist, the PNP manager locates the INF file.

It reports a set of hardware ids, the bus driver has no idea if there an fdo, lower filter, upper filter, etc. The inf which matches one of the HW ids sets up the fdo as well as possible lower and upper device filters. The class in which the device is installed under dictates the class filters

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?11/?16/?2013 10:56 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] How a device stack is made for a particular device?

Lets talk about a USB device,Soon i plug in a device, Function driver for the bus gets the notification,It informs the
PNP manager,and creates the PDO for the just plugged in device.

Now the pnp manager gathers the information from the PDO like HWID,Capabilities,Resources etc.
Based on the HWID pnp manager locate for the INF files for the best match and instaclls the rest of the driver and creates
the complete device stack.

Now my question is suppose the device stack consists of PDO,lower filter driver,Function driver and upper filter driver.
SO when PDO reports the HWIDS which HWID does it report? is it for lower filter driver or function driver or upper filter driver
or all of them at once?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

Doron: so ypu mean to there is one INF file per driver stack which has information about the filter as well as the function driver?

Yes. An inf can use the Needs and Include directives to leverage another inf as well

d

Bent from my phone


From: xxxxx@gmail.commailto:xxxxx
Sent: ?11/?16/?2013 12:33 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] How a device stack is made for a particular device?

Doron: so ypu mean to there is one INF file per driver stack which has information about the filter as well as the function driver?


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

> Now the pnp manager gathers the information from the PDO like HWID,Capabilities,Resources etc.

Yes. MN_QUERY_ID

SO when PDO reports the HWIDS which HWID does it report?

QUERY_ID is called before ANY possible filters are attached, it is always called to a raw PDO.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

“QUERY_ID is called before ANY possible filters are attached, it is always
called to a raw PDO.”

Except of course when it isn’t. A bus filter driver can instantiate a PDO
upper filter before any PNP operations directed at the PDO occur.

Mark Roddy

On Sun, Nov 17, 2013 at 1:28 PM, Maxim S. Shatskih
wrote:

> > Now the pnp manager gathers the information from the PDO like
> HWID,Capabilities,Resources etc.
>
> Yes. MN_QUERY_ID
>
> > SO when PDO reports the HWIDS which HWID does it report?
>
> QUERY_ID is called before ANY possible filters are attached, it is always
> called to a raw PDO.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

Bus filter is a borderline technology just near hooking :slight_smile:

But yes, you’re correct. And I’m correct too, in some narrower sense - PnP will not add any filters itself before QUERY_ID.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

“Mark Roddy” wrote in message news:xxxxx@ntdev…
“QUERY_ID is called before ANY possible filters are attached, it is always called to a raw PDO.”

Except of course when it isn’t. A bus filter driver can instantiate a PDO upper filter before any PNP operations directed at the PDO occur.

Mark Roddy

On Sun, Nov 17, 2013 at 1:28 PM, Maxim S. Shatskih wrote:

> Now the pnp manager gathers the information from the PDO like HWID,Capabilities,Resources etc.

Yes. MN_QUERY_ID

> SO when PDO reports the HWIDS which HWID does it report?

QUERY_ID is called before ANY possible filters are attached, it is always called to a raw PDO.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

xxxxx@gmail.com wrote:

Doron: so ypu mean to there is one INF file per driver stack which has information about the filter as well as the function driver?

Yes, this is an important point that was discussed earlier this month.
When an INF matches some hardware ID, it is expected to provide ALL of
the drivers for that device. You can’t have an INF file for the
function driver, and an INF for a lower filter, and an INF for an upper
filter. Each new INF replaces the ones before it.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Windows comes with at least one in-box bus filter driver, or at least it
did the last time I looked. There is actually nothing hackish involved, no
undocumented interfaces for example.

Mark Roddy

On Mon, Nov 18, 2013 at 9:18 AM, Maxim S. Shatskih
wrote:

> Bus filter is a borderline technology just near hooking :slight_smile:
>
> But yes, you’re correct. And I’m correct too, in some narrower sense -
> PnP will not add any filters itself before QUERY_ID.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> “Mark Roddy” wrote in message news:xxxxx@ntdev…
> “QUERY_ID is called before ANY possible filters are attached, it is always
> called to a raw PDO.”
>
> Except of course when it isn’t. A bus filter driver can instantiate a PDO
> upper filter before any PNP operations directed at the PDO occur.
>
>
>
> Mark Roddy
>
>
>
> On Sun, Nov 17, 2013 at 1:28 PM, Maxim S. Shatskih
> wrote:
>
> > Now the pnp manager gathers the information from the PDO like
> HWID,Capabilities,Resources etc.
>
>
> Yes. MN_QUERY_ID
>
>
> > SO when PDO reports the HWIDS which HWID does it report?
>
>
> QUERY_ID is called before ANY possible filters are attached, it is always
> called to a raw PDO.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

Calling it hooking is a gross overstatement. It does require efforts to
attach to new PDO’s but there is no hook involved. It was documented to
some degree in Walter Oney’s book on drivers by Microsoft press and all you
have to do is look at the reviewers to see that it is quite a different
thing than hooking which none of them would have subscribed to. I’ve
written multiple bus filter drivers, and I sure will not hook.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Monday, November 18, 2013 9:19 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] How a device stack is made for a particular device?

Bus filter is a borderline technology just near hooking :slight_smile:

But yes, you’re correct. And I’m correct too, in some narrower sense -
PnP will not add any filters itself before QUERY_ID.


Maxim S. Shatskih
Microsoft MVP on File System And Storage xxxxx@storagecraft.com
http://www.storagecraft.com

“Mark Roddy” wrote in message news:xxxxx@ntdev…
“QUERY_ID is called before ANY possible filters are attached, it is always
called to a raw PDO.”

Except of course when it isn’t. A bus filter driver can instantiate a PDO
upper filter before any PNP operations directed at the PDO occur.

Mark Roddy

On Sun, Nov 17, 2013 at 1:28 PM, Maxim S. Shatskih
wrote:

> Now the pnp manager gathers the information from the PDO like
HWID,Capabilities,Resources etc.

Yes. MN_QUERY_ID

> SO when PDO reports the HWIDS which HWID does it report?

QUERY_ID is called before ANY possible filters are attached, it is always
called to a raw PDO.


Maxim S. Shatskih
Microsoft MVP on File System And Storage xxxxx@storagecraft.com
http://www.storagecraft.com


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Oh, well THERE’s a recommendation. :wink:

Seriously, though… bus filters are not intrinsically evil (like hooking is). But they *are* complicated, and if I’m not mistaken, developing them is not supported by Microsoft. I don’t think, for example, that you could openly WHQL something with a bus filter driver. I dunno. Maybe I’m wrong…

Peter
OSR

I’m fairly certain that there exist whql’d drivers that do bus filtering :slight_smile:

Mark Roddy

On Mon, Nov 18, 2013 at 3:29 PM, wrote:

>


>
> Oh, well THERE’s a recommendation. :wink:
>
> Seriously, though… bus filters are not intrinsically evil (like hooking
> is). But they are complicated, and if I’m not mistaken, developing them
> is not supported by Microsoft. I don’t think, for example, that you could
> openly WHQL something with a bus filter driver. I dunno. Maybe I’m
> wrong…
>
> Peter
> OSR
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

>…developing them is not supported by Microsoft

This is the only thing that matters to the Windows fanboy…

This is why he equates bus filters to hooking - anything that happens to be not supported by MSFT is, in his understanding of things, evil…

Anton Bassov

>Except of course when it isn’t. A bus filter driver can instantiate a PDO
upper filter before any PNP operations directed at the PDO occur.

And this is done by watching on QUERY_DEVICE_RELATIONS/BusRelations and attaching your filter DO on any new PDO.

There are legitimate reasons for bus filters - for example one needs to
redefine pnp ids for PDOs in order to insert a multiplexing driver, or a
redirecting driver. It is a shame that KMDF doesn’t support a bus filter
model, the functionality is all documented and supported via WDM interfaces.

Mark Roddy

On Mon, Nov 18, 2013 at 4:30 PM, wrote:

> >…developing them is not supported by Microsoft
>
>
> This is the only thing that matters to the Windows fanboy…
>
> This is why he equates bus filters to hooking - anything that happens to
> be not supported by MSFT is, in his understanding of things, evil…
>
>
>
> Anton Bassov
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

> This is why he equates bus filters to hooking - anything that happens to be not supported by MSFT

No.

I equated them only due to them both violating existing architecture. Yes, I know that you can make bus filter 100% stable, which is rather hard with hooking (unless you never unhook).

BTW, hooking is evil same way in Linux too, and I don’t think Linus will allow a hooker module to the master kernel branch.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

How does it “violate existing architecture”?

Mark Roddy

On Tue, Nov 19, 2013 at 7:35 AM, Maxim S. Shatskih
wrote:

> > This is why he equates bus filters to hooking - anything that happens to
> be not supported by MSFT
>
> No.
>
> I equated them only due to them both violating existing architecture.
> Yes, I know that you can make bus filter 100% stable, which is rather hard
> with hooking (unless you never unhook).
>
> BTW, hooking is evil same way in Linux too, and I don’t think Linus will
> allow a hooker module to the master kernel branch.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

>and I don’t think Linus will allow a hooker module to the master kernel branch.

I will have my own branch. With blackjack and hookers.

> >and I don’t think Linus will allow a hooker module to the master kernel branch.

I will have my own branch. With blackjack and hookers.

Will your customers use your branch or Linus’s one? or Redhat’s one?


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com