You are on page 1of 13


This term paper aims to provide an overview of the concepts of device management in Windows operating system. It deals with the meaning of the term device management, how device management is done in case of Windows operating system and various terms and concepts related with device management in Windows operating system. It contains all the basic information about the device management service provided by the windows operating system.

To perform useful functions, processes need access to the peripherals connected to the computer, which are controlled by the kernel through device drivers. A device driver is a computer program that enables the operating system to interact with a hardware device. It provides the operating system with information of how to control and communicate with a certain piece of hardware. The driver is an important and vital piece to a program application. The design goal of a driver is abstraction the function of the driver is to translate the OS mandated function calls (programming calls) into device specific calls. In theory the device should work correctly with the suitable driver. Engineers are most likely to write code for device drivers. They work on: Video cards, Sound cards. Printers, Scanners, Modems, LAN cards. The common levels of abstraction of device drivers are: 1. On the hardware side:
• • • •

Interfacing directly. Using a high level interface (Video BIOS). Using a lower-level device driver (file drivers using disk drivers). Simulating work with hardware, while doing something entirely different.

2. On the software side:
• • • •

Allowing the operating system direct access to hardware resources. Implementing only primitives. Implementing an interface for non-driver software (Example: TWAIN). Implementing a language, sometimes high-level (Example Postscript).

For example, to show the user something on the screen, an application would make a request to the kernel, which would forward the request to its display driver, which is then responsible for actually plotting the character/pixel.[5] A kernel must maintain a list of available devices. This list may be known in advance (e.g. on an embedded system where the kernel will be rewritten if the available hardware changes), configured by the user (typical on older PCs and on systems that are not designed for personal use) or detected by the operating system at run time (normally called plug and play). In a plug and play system, a device manager first performs a scan on different hardware buses, such as Peripheral Component Interconnect (PCI) or Universal Serial Bus (USB), to detect installed devices, then searches for the appropriate drivers. As device management is a very OS-specific topic, these drivers are handled differently by each kind of kernel design, but in every case, the kernel has to provide the I/O to allow drivers to physically access their devices through some port or memory location. Very important decisions have to be made when designing the device management system, as in some designs accesses may

16550 UART hardware differs from PL-011. When a calling program invokes a routine in the driver. In turn. Physical layers communicate with specific device instances. They usually provide the interrupt handling required for any necessary asynchronous time-dependent hardware interface. Modern computer buses can use both parallel and bit serial connections. it uses the physical layer to speak to the logical layer. thus saving kernel memory. A device driver simplifies programming by acting as translator between a hardware device and the applications or operating systems that use it.sys files modules contain loadable device drivers. For example. . Conventionally. or connected by switched hubs. The advantage of loadable device drivers is that they can be loaded only when necessary and then unloaded. However. Programmers can write the higher-level application code independently of whatever specific hardware device. and can be wired in either a multidrop (electrical parallel) or daisy chain topology. This would be managed by a serial port logical layer. BUS: In computer architecture. the physical layer needs to communicate with a particular serial port chip. A driver typically communicates with the device through the computer bus or communications subsystem to which the hardware connects. Early computer buses were literally parallel electrical wires with multiple connections. a serial port needs to handle standard communication protocols such as XON/XOFF that are common for all serial port hardware. Inversely. the logical layer calls upon the physical layer to implement OS requests in terms understandable by the hardware. The Microsoft Windows . or between computers.involve context switches. the driver issues commands to the device. making the operation very CPU-intensive and easily causing a significant performance overhead Device driver In computing. Drivers are hardware-dependent and operating-system-specific. Logical layers process data for a class of devices such as Ethernet ports or disk drives. but the term is now used for any physical arrangement that provides the same logical functionality as a parallel electrical bus. the driver may invoke routines in the original calling program. Device drivers can be abstracted into logical and physical layers. The physical layer addresses these chipspecific variations. Once the device sends data back to the driver. when a hardware device needs to respond to the OS. a bus is a subsystem that transfers data between components inside a computer. OS requests go to the logical layer first. a device driver or software driver is a computer program allowing higher-level computer programs to interact with a hardware device. as in the case of USB.

In the typical desktop application. and data connections in each direction usually means that most serial buses have more conductors than the minimum of one used in the 1-Wire and UNI/O serial buses. which carry data words in parallel on multiple wires. PCI: Conventional PCI (PCI is an initialism formed from Peripheral Component Interconnect. One partial solution to this problem has been to double pump the bus. Often. I²C can be used as both an internal bus. and protocols. These devices can take either the form of an integrated circuit fitted onto the motherboard itself. the CPU and internal memory). PCI is being replaced by PCI-X and PCI Express. but as of 2011. again blurring the conceptual distinction. "bus" meant an electrically parallel system. Even the lines between internal and external are sometimes fuzzy. power consumption. despite having fewer electrical connections. or an expansion card that fits into a slot. because they are intended to connect to local devices. As data rates increase. An internal bus connects all the internal components of a computer to the motherboard (and thus. An external bus connects external peripherals to the motherboard. and it in other computer types. so most modern serial buses use daisy-chain or hub designs. electrical characteristics. and Serial ATA are examples of this. where it displaced ISA and VESA Local Bus as the standard expansion bus.bus). USB serves as a peripheral bus. . The specification can be purchased from the PCI Special Interest Group (PCI-SIG). many motherboards are still made with one or more PCI slots The PCI specification covers the physical size of the bus (including the size and spacing of the circuit board edge electrical contacts). which carry data in bit-serial form. and InfiniBand is intended to replace both internal buses like PCI as well as external ones like Fibre Channel. FireWire. and modern systems are blurring the lines between buses and networks. bus timing. This is no longer the case. called a planar device in the PCI specification. although the difference is largely conceptual rather than practical. The addition of extra power and control connections. or an external bus (where it is known as ACCESS. differential drivers. because a serial bus inherently has no timing skew or crosstalk. electromagnetic interference and crosstalk across parallel buses become more and more difficult to circumvent. The arrival of technologies such as InfiniBand and HyperTransport is further blurring the boundaries between networks and buses. a serial bus can actually be operated at higher overall data rates than a parallel bus. Multidrop connections do not work well for fast serial buses.At one time. the problems of timing skew. not to those in other machines or external to the computer. USB. Buses can be parallel buses. Network connections such as Ethernet are not generally regarded as buses. These types of buses are also referred to as a local bus. with electrical conductors similar or identical to the pins on the CPU.[1] part of the PCI Local Bus standard and often shortened to PCI) is a computer bus for attaching hardware devices in a computer. The PCI Local Bus was implemented in PCs. Most computers have both internal and external buses. but it also sees some use as a networking utility and for connectivity between different computers. or serial buses.

TV tuner cards and disk controllers. a program called an interrupt handler is installed. it can issue the request and continue with some other execution. or a process context switch. If a process does not voluntarily yield the CPU (for example.[2] Many devices previously provided on expansion cards are either commonly integrated onto motherboards.Typical PCI cards used in PCs include: network cards. by performing an I/O operation). A context switch can mean a register context switch. Switching from one process to another requires a certain amount of time for doing the administration . a timer interrupt fires. the CPU can be interrupted and presented with the read. updating various tables and list etc. modems. and the operating system schedules another process for execution instead. one process needs to be switched out of the CPU so another process can run. [edit] Interrupt handling Modern architectures are interrupt driven. PCI is still used for certain specialized cards Context switch A context switch is the computing process of storing and restoring state (context) of a CPU so that execution can be resumed from the same point at a later time. This enables multiple processes to share a single CPU. a task context switch. When to switch? There are three situations where a context switch needs to occur. What constitutes the context is determined by the processor and the operating system. and then PCI Express. extra ports such as USB or serial. The context switch is an essential feature of a multitasking operating system. Modern PCs often have no cards fitted.saving and loading registers and memory maps. a thread context switch. This means that if the CPU requests data from a disk. However. or more commonly available in USB and PCI Express versions. the scheduler allows every task to run for some certain amount of time. it does not need to busy-wait until the read is over. the preferred interface for video cards became AGP. called its time slice. PCI video cards replaced ISA cards until growing bandwidth requirements outgrew the capabilities of PCI. When the read is over. They are: [edit] Multitasking Most commonly. . For interrupts. Context switches are usually computationally intensive and much of the design of operating systems is to optimize the use of context switches. This ensures that the CPU cannot be monopolized by any one processor-intensive application. and it is the interrupt handler that handles the interrupt from the disk. within some scheduling scheme. Within a preemptive multitasking operating system. sound cards. PCI video cards remain available for use with old PCs without AGP or PCI Express slots. for example.

the hardware automatically switches a part of the context (at least enough to cause the interrupt handler to start running). Historically. However. Often only a minimal part of the context is changed in order to minimize the amount of time spent handling the interrupt. The kernel does not spawn or schedule a special process to handle interrupts. [edit] User and kernel mode switching When a transition between user mode and kernel mode is required in an operating system. a direct access storage device.When an interrupt occurs. a context switch is not necessary. the context in effect before the interrupt occurred is restored so that the interrupted process can resume execution in its proper state. depending on details of the particular hardware and software designs. IBM introduced the term to cover three different device types: 1. Once interrupt servicing is complete. magnetic drums 3. is any secondary storage device which has relatively low access time relative to its capacity. a mode transition is not by itself a context switch. The handler may save additional context. a context switch may also take place at this time. depending on the operating system. Components of I/O Subsystem . or DASD ( / ˈdæzdiː/). occasionally and incorrectly called random access (although that term survives when referring to memory or RAM). but instead the handler executes in the (often partial) context established at the beginning of interrupt handling. data cells The direct access capability. • • System Devices Pdf downloaded Direct Access Storage Devices In mainframe computers and some minicomputers. The latter required a proportionally long time to access a distant point in a medium. disk drives 2. of those devices stood in contrast to sequential access used in tape drives.

and too many changes to process I/O can break existing applications and drivers. Windows XP I/O automates this process. This compatibility was essential because the I/O subsystem provides the interface to all devices. The driver ensures that the memory for the queue comes from the correct pool. while existing Windows 2000 drivers will work with Windows XP.I/O Subsystem Enhancements The I/O subsystem consists of kernel components that provide an interface to hardware devices for applications and other mandatory system components. but instead calls IoCsqInsertIrp. drivers handle IRP queuing and do not have to handle IRP cancellations. Enhancements were made by adding new routines. it cannot be canceled. To remove an IRP from the queue. the driver can either specify an IRP to be retrieved. When the driver actually wants to insert something into the queue. and the first IRP in the queue will be retrieved. . In Windows XP. Intelligence in the queuing process lets the I/O routines handle requests rather than drivers in cases where the I/O is canceled. For this reason. they must be rewritten to take advantage of the new I/O improvements. The driver provides routines to insert and remove IRPs from a queue. and it provides a lock to be held while calling these routines. including the following: • • • • • • • • New cancel queue File system filter driver routines Improved low-memory performance I/O throttling Direct Memory Access (DMA) improvements WebDAV Redirector System Restore Volume Snapshot Service New Cancel Queue Rather than having drivers perform device queuing and handling the I/O request packet (IRP) cancellation race. available to drivers written to take advantage of the new Windows XP functionality. Once the IRP has been retrieved. Windows XP enhances the I/O subsystem while retaining complete compatibility with drivers written for Windows 2000. A common problem with cancellation of IRPs in a driver is synchronization between the cancel lock or the InterlockedExchange in the I/O Manager with the driver's queue lock. it is expected that the driver will process the IRP and complete it quickly. Windows XP abstracts the cancel logic in the routines while allowing the driver to implement the queue and associated synchronization. it does not call its insertion routine. or pass NULL.

If a driver crashed attempting to perform illegal functions. if necessary. The driver should try to access these new function pointers only when the driver successfully gets the adapter using DEVICE_DESCRIPTION_VERSION2. together we determined the functionality required. WebDAV Redirector Windows XP includes a new component — the WebDAV redirector. If the system can’t allocate memory. Earlier versions of the kernel and drivers contained memory allocation requests that had to succeed even when the memory pool was low. I/O Throttling Another improvement for low-memory conditions is I/O throttling. This allows the system to continue at a slower pace until more resources are available. These changes allow drivers and other components to take appropriate error actions. Two important I/O allocation routines used “must succeed. These allocations would crash the system if no memory were available. The current Hardware Abstraction Layers (HAL). and provided kernel-mode support routines to let them accomplish what needed to be done without harming the rest of the system. The WebDAV redirector allows applications on Windows XP to connect to the Internet. These three entries will be accessible to any driver. To safely check whether the new functionality exists. which don't support the new interface. it throttles down to process one page at a time. the system would blue screen if these routines were used. Improved Low-Memory Performance Windows XP is more resilient during periods of low memory because “must succeed” allocations are no longer permitted. kernel components and drivers are no longer allowed to request “must succeed” allocations. will fail the operation because of the version number. The WebDAV protocol is an extension to Hypertext Transfer Protocol (HTTP) that .File System Filter Driver Routines Several new kernel-mode support routines provide greater all-around reliability. which uses IoGetDmaAdapter. DMA Improvements Three new entries are added to the end of the DMA_OPERATIONS structure. For Windows XP. memory allocation routines will not allocate memory if the pool is too low. HALs that support this feature will understand the new version and will succeed the request. assuming all the other parameters are in order. These routines are included in the Windows Installable File System (IFS) Kit for Windows XP. the driver should set the version field of the DEVICE_DESCRIPTION structure provided to IoGetDmaAdapter to DEVICE_DESCRIPTION_VERSION2. If memory couldn’t be allocated. and the other for Memory Descriptor List (MDL) allocations. Microsoft worked with third-party developers to test their filter drivers. and to natively read and write data on the Internet. rather than an extreme approach such as bug checking a machine.” with the first being for IRP allocation. using freely allocated resources.

System Restore is a feature only of Windows XP Personal and the 32-bit version of Windows XP Professional. it should flush the volume and hold all file resources to make sure that nothing more . not a file system filter driver. Volume Snapshot Service A volume snapshot is a point-in-time copy of that volume. as well as a storage filter driver. even though the files may be changing during the backup.msnusers. and it is not a feature of the server versions of Windows The simplest ways to create a WebDAV share are: • • Use Microsoft Internet Information Server (IIS).allows data to be written to HTTP targets such as the Microsoft MSN® Web Communities. enter these details in the Connect Using Different User Name dialog if you are using mapped network drive. In IIS. The WebDAV redirector provides file system-level access to these servers in the same that the existing redirector provides access to SMB/CIFS servers. you only need to make a directory browsable to access it through WebDAV and allow writes. Use MSN Communities.sys. use http://www. The credentials you need in this case are your Passport credentials. The choice of an IOCTL instead of an FSCTL ensures that even legacy file system drivers will pass the IOCTL down. This is actually intended for interpretation by file systems. This is because all file systems should pass the IOCTL down to a lower-level driver that is waiting to process the IOCTL after the file system. The snapshot is typically used by a backup application so that it may backup files in a consistent as the target. One important new snapshot-related I/O Control (IOCTL) that affects file systems is IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES. System Restore includes a file system filter driver called Sr. and you can also save to it. which helps to implement a copyon-write process. even though it is an /u:yourpassportaccount@hotmail. One way to access a WebDAV share is to use the net use command. File Cabinets in MSN Communities are WebDAV shares. For example: net use http://www. for example: NET USE * http://webserver/davscratch To connect to an MSN Community.msnusers. System Restore System Restore is a combination of a file system filter driver and user-mode services that provide a way for user to unwind configuration operations and restore a system to an earlier configuration. When a file system such as NTFS receives the IOCTL. This IOCTL is sent by the Volume Snapshot Service. or use the /u: switch with the net use command. Windows XP includes a framework for orchestrating the timing for a snapshot. that uses a copy-on-write technique in order to create a snapshot.

including: • FAT32 on DVD-RAM DVD-RAM disks can appear as both CD/DVD devices and as rewriteable disks. for example: foo:$i30:$INDEX_ALLOCATION foo::$DATA foo::$REPARSE_POINT foo::$ATTRIBUTE_LIST o NTFS's QueryBitmap FSCTL will now return results on a byte boundary rather than page boundary. NTFS will now defragment Reparse points. In Windows 2000. NTFS will now defragment the MFT. the NTFS file system has exposed APIs that allow a user-mode application to query the allocated ranges of files on disk. Windows XP will allow DVD-RAM media in DVD-RAM drives to be formatted and used with the FAT32 file system. . this was limited to the page granularity for noncompressed files. NTFS will now defragment at the cluster boundary for noncompressed files. then it will be rejected. so there is no limit to how much at once can be moved. the file system then releases the resources and returns. When the IRP completes or is canceled. This means encrypted files will no longer need to be opened with read access. and attribute_lists. they do not function on the master file table (MFT). the PageFile. The feature set in Windows XP changes the behavior on NTFS as follows: o o o o The defragmentation APIs will no longer defragment data by using the system cache. This was not allowed in Windows 2000. Changes in Existing I/O Features Windows XP includes several changes in existing I/O features. for example. The API can move an MFT segment even if a file with its File Entry in that section is currently open. or NTFS attributes. these APIs have a number of limitations. In Windows 2000. If there is no available space in the MFT to describe the change.0. and optimize file arrangements in order to defragment (or carefully fragment) files in order to minimize seeks while processing file I/O.gets dirty. This is through the regular code path. These can now be opened for file read attributes and synchronize. • Defragmentation APIs Since the release of Windows NT 4. and any part of it can be moved other than the first 0x10 clusters. bitmaps. NTFS will now defragement for cluster sizes greater than 4 KB. The files are named using the regular syntax (file:name:type).

because the Windows XP memory manager can reuse prototype page table entries (PPTE) for any parts of a section that do not have a mapped view. • Verifiers There are new Verifier levels in addition to a new deadlock verifier. In fact. it only creates PPTEs for active views based on the view size (not the section size). in Windows XP. A constraint that had existed in earlier versions of the memory manager (creating Prototype Page Table entries for all pages in the section) does not apply. The MFT Zone is now just an NTFS-internal hint for the NTFS allocation engine. This is a performance optimization. the mount will fail. • • Default NTFS ACL The default access control list (ACL) on NTFS volumes has been strengthened. • New flag: FILE_READ_ONLY_VOLUME GetVolumeInformation now returns a FILE_READ_ONLY_VOLUME for read-only volumes. it was not possible to defragment the file tail between valid data length (VDL) and end of file (EOF). • • Remote Storage Service (RSS) on MO media Encrypting File System (EFS) The Client Side Caching database can now be encrypted. Read-only flag on directories The Read-only attribute has no defined effect on folders. This stays in effect until the handle is closed. This is done by calling FSCTL_MARK_HANDLE and passing MARK_HANDLE_PROTECT_CLUSTERS as an argument. o You can now defragment into or out of the MFT Zone. In Windows 2000. • Read-only NTFS NTFS will now mount read-only on an underlying read-only volume. • Write-through mode .• NTFS will now defragment all parts of a stream. Large Files o Windows XP and Windows 2000 Service Pack 2 are able to create sections on arbitrarily large mapped files. Windows Explorer is using this attribute on a folder to indicate that there is extra metadata in the folder that the shell should look at. o It is possible to Pin an NTFS file so that it may not be defragmented using FSCTL_MOVE_FILE. If the volume requires a log restart or a Chkdsk. up to and including the allocation size. However.

DWORD cchBufferLength. Parameters lpszVolumeName Supplies the volume name. On systems with 256 MB or more RAM. In such a case. the kernel and HAL pages will be marked read-only. Driver Verifier disables large pages. dispatch tables. LPWSTR lpszVolumePathNames. Read-only Kernel and HAL Pages On many Windows XP-based systems. The change to read-only kernel and HAL does not happen on all systems: • • • • On systems with less than 256 MB RAM. New Filter Driver Functions Windows XP includes several new filter driver function. lpszVolumePathNames Returns the volume path names. including: • • • • • • • • • SetFileShortName. the read-only restriction is used. On all systems. This is a new Win32 function to set the short name of a file on NTFS. The returned lpcchReturnLength will include the extra tailing null characteristic of a Multi-Sz. the read-only restriction isn’t used because Windows XP uses large pages to map the kernel and HAL. cchBufferLength Supplies the size of the return buffer. This has affected drivers that were attempting to patch system code. GetVolumePathNamesForVolumeName.On hot-plug media. unless ERROR_MORE_DATA is returned. lpcchReturnLength . the FAT file system will work in WriteThrough mode. BOOL GetVolumePathNamesForVolumeName( LPCWSTR lpszVolumeName. or data structures. PDWORD lpcchReturnLength ) This routine returns a Multi-Sz list of volume path names for the given volume name. the list returned is as long as possible and may contain a part of a volume path. so you can enable this on any machine of any size in order to test your code. This new function allows you to list all VolumePaths that a VolumeName may be mounted on. the read-only restriction is used for all driver code because drivers are never mapped with large pages. This is to eliminate corruption that could occur on media such as CompactFlash when it is unplugged from the system without using the Safely Remove Hardware user interface.

This is a way to preserve the C2 ‘Object Reuse’ requirement but not force file systems to write zeroes into file-tails. Definitions: o VDL = ‘Valid Data Length’. SetFileValidData. By definition. Expected users include: A Restore application that has the ability to pour the raw clusters directly onto the disk through hardware channel. Any reads from the file tail are implicitly returned as zeroes by NTFS. Clearly. o Multimedia/database tools that need to create large files. The new file information classes can be passed as FileInformationClass parameter values to ZwQueryInformationFile.Returns the number of characters copied back to the return buffer on success or the total number of characters necessary for the buffer on ERROR_MORE_DATA. this privilege is only used to allow nonadministrators and remote users make the SetValidData call. then "pump in" the data directly to the disk device. we have added an NTFS-only function call to set the Valid Data Length on a file. Return Value FALSE Failure. it will allow validated users to perform actions on the disk currently restricted to administrators. In the future. • • FileIdBothDirectoryInformation and FileIdFullDirectoryInformation. Each stream has such a value. available to administrative users with SeManageVolumePrivilege (described later in this section). The SeManageVolumePrivilege will let nonadministrators and remote users do administrative disk tasks on a machine. each stream has such a region and it may be zero length. Each stream has such a value. and any data between the previous VDL and the start of this write are written to be zeroes. o File Tail = the region from VDL to EOF. This provides a method for informing the file system that the range contains valid user data and it can be returned to the user. ZwSetInformationFile. SeManageVolumePrivilege. and IRP_MN_QUERY_DIRECTORY. These two new FileInfo changes have been added to the file information class enumeration. VDL must be less than or equal to the EOF. but not pay the zero-filling cost during the following times: (a) file extend time (the cost here is to make the extend a synchronous operation) (b) create time (the cost here is filling the file with zeroes) o Served-metadata cluster file systems that need to remotely extend the file. With Windows XP. In Windows XP. o • . o EOF = Allocated file length. TRUE Success. Any writes into the file tail cause VDL to be increased to equal the end of this write. NTFS has the concept of Valid Data Length on a file stream.

These routines supersede ExInitializeWorkItem and ExQueueWorkItem.• • IoAllocateWorkItem and IoQueueWorkItem. The disk device object need not be an actual disk but in general associated with storage. . IoGetDiskDeviceObject. Returns the disk device object associated with a file system volume device object. and are essential to support driver unloading.