Hi;
1-) “The I/O Manager calls a DriverEntry routine once it loads the driver”
The Windows 2000 Device Driver Book, A Guide for Programmers, Second Edition
2-)“If so, for each such driver the PnP manager ensures it is loaded (calls DriverEntry if necessary) (…)”
http://msdn2.microsoft.com/en-us/library/ms794729.aspx
3-)“If your driver is mapped for the first time, the Memory Manager will call its DriverEntry routine”
http://mti.xidian.edu.cn/wwwroot/zhj/content/4.ppt
Which one is true?
Thanks
The Windows 2000 book is actually a rework of an NT driver book, so I doubt
its accuracy. The memory manager just maps the driver it definitely does
not call it. Note: the answer is it depends, there are functions to load
the driver and not call DriverEntry and functions that load and do the call.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply
wrote in message news:xxxxx@ntdev…
> Hi;
> 1-) “The I/O Manager calls a DriverEntry routine once it loads the driver”
> The Windows 2000 Device Driver Book, A Guide for Programmers, Second
> Edition
>
> 2-)“If so, for each such driver the PnP manager ensures it is loaded
> (calls DriverEntry if necessary) (…)”
> http://msdn2.microsoft.com/en-us/library/ms794729.aspx
>
> 3-)“If your driver is mapped for the first time, the Memory Manager will
> call its DriverEntry routine”
> http://mti.xidian.edu.cn/wwwroot/zhj/content/4.ppt
> 1-) “The I/O Manager calls a DriverEntry routine once it loads the driver”
Yes, IO calls it for a driver which has an SC database key AND is loaded by
ZwLoadDriver (SC’s StartService is mapped to ZwLoadDriver).
It is called after MmLoadSystemImage and after creation of the driver object.
Bare MmLoadSystemImage called by import resolution or by ZwSetSystemInformation
will NOT call DriverEntry (will call the DllInitialize entry for a kernel-mode
DLL though).
DriverEntry is called only for the images which have the driver object, and
these are only the drivers registered in the SC database.
–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
> DriverEntry is called only for the images which have the driver object, and these
are only the drivers registered in the SC database.
Not true…
If driver is not registered in the SC database, then it is impossible to load it with ZwLoadDriver() - ZwSetSystemInformation() is the only option (in such case it will get loaded only into the caller’s address space and paged to the disk.) There are 2 possibilities here:
-
You specify LoadImage infoclass. In this case a driver will get loaded, but its DriverEntry() will not get invoked
-
You specify LoadAndCallImage infoclass. In this case DriverEntry() will get invoked with NULL parameters
Anton Bassov
I often see newbs concerned about whether “the I/O Manager” does this or “the PnP Manager” does that, or whether “the Kernel” does something else or the “the HAL” does it.
The bottom line is that these are often distinctions without a meaningful difference. It’s very difficult to separate the PnP Manager from the I/O Manager. Or the Kernel from the HAL.
And what does it really mean to ask “who” does this or that.
The fact of the matter is that the NT Operating System does a bunch of stuff, and it makes lots of calls from one executive subsystem (“Manager”) into others to perform its work.
Somebody asked me the other day which “Manager” translated the handle passed on a Win32 “ReadFile” function to a PFILE_OBJECT. Well, the actual handle table functions are in Ex. But the code is originally called from Io, which calls Ob. I think. In any case, the answer is… WHATEVER. It’s the I/O Manager’s responsibility to do the translation. He calls a bunch o’ functions to accomplish that translation. So, is the answer “the I/O Manager” or is it “The Object Manager” or is it “The Executive”??
Likewise, the question of “Who calls DriverEntry”. Answer: Windows. If you want to know which module contains the actual call to the function, which isn’t necessarily particularly interesting, a breakpoint will provide the answer.
Peter
OSR