Windows® Internals, Sixth Edition, Part 2

When you enter the !object command and specify an object manager directory object, the kernel debugger dumps the contents of the directory according to the way the object manager organizes it internally. For fast lookups, a directory stores objects in a hash table based on a hash of the object names, so the output shows the objects stored in each bucket of the directory’s hash table.

As Figure 8-6 illustrates, a device object points back to its driver object, which is how the I/O manager knows which driver routine to call when it receives an I/O request. It uses the device object to find the driver object representing the driver that services the device. It then indexes into the driver object by using the function code supplied in the original request; each function code corresponds to a driver entry point. (The function codes shown in Figure 8-6 are described in the section IRP Stack Locations later in this chapter.)

A driver object often has multiple device objects associated with it. The list of device objects represents the physical or logical devices that the driver controls. For example, each partition of a hard disk has a separate device object that contains partition-specific information. However, the same hard disk driver is used to access all partitions. When a driver is unloaded from the system, the I/O manager uses the queue of device objects to determine which devices will be affected by the removal of the driver.

Figure 8-6. The driver object

EXPERIMENT: Displaying Driver and Device Objects

You can display driver and device objects with the kernel debugger !drvobj and !devobj commands, respectively. In the following example, the driver object for the keyboard class driver is examined, and its lone device object viewed:lkd> !drvobj kbdclass Driver object (86e379a0) is for: \Driver\kbdclass Driver Extension List: (id , addr) Device Object list: 86e1d488 86eaec28 lkd> !devobj 86eaec28 Device object (86eaec28) is for: KeyboardClass0 \Driver\kbdclass DriverObject 86e379a0 Current Irp 00000000 RefCount 0 Type 0000000b Flags 00002044 DevExt 86eaece0 DevObjExt 86eaedc0 ExtensionFlags (0x00000800) Unknown flags 0x00000800 AttachedDevice (Upper) 86e15a40 \Driver\ctrl2cap AttachedTo (Lower) 86e15020 \Driver\i8042prt Device queue is not busy

Notice that the !devobj command also shows you the addresses and names of any device objects that the object you’re viewing is layered over (the AttachedTo line) as well as the device objects layered on top of the object specified (the AttachedDevice line).

Using objects to record information about drivers means that the I/O manager doesn’t need to know details about individual drivers. The I/O manager merely follows a pointer to locate a driver, thereby providing a layer of portability and allowing new drivers to be loaded easily.

Opening Devices

A file object is a kernel-mode data structure that represents a handle to a device. File objects clearly fit the criteria for objects in Windows: they are system resources that two or more user-mode processes can share, they can have names, they are protected by object-based security, and they support synchronization. Shared resources in the I/O system, like those in other components of the Windows executive, are manipulated as objects. (See Chapter 3 in Part 1 for a description of the object manager and Chapter 6 in Part 1 for information on object security.)

File objects provide a memory-based representation of resources that conform to an I/O-centric interface, in which they can be read from or written to. Table 8-1 lists some of the file object’s attributes. For specific field declarations and sizes, see the structure definition for FILE_OBJECT in WDM.h.

Table 8-1. File Object Attributes

Attribute

Purpose

File name

Identifies the physical file that the file object refers to, which was passed in to the CreateFile API.

Current byte offset

Identifies the current location in the file (valid only for synchronous I/O).

Share modes

Indicate whether other callers can open the file for read, write, or delete operations while the current caller is using it.

Open mode flags

Indicate whether I/O will be synchronous or asynchronous, cached or noncached, sequential or random, and so on.

Pointer to device object

Indicates the type of device the file resides on.

Pointer to the volume parameter block (VPB)

Indicates the volume, or partition, that the file resides on.

Pointer to section object pointers

Indicates a root structure that describes a mapped/cached file. This structure also contains the shared cache map, which identifies which parts of the file are cached (or rather mapped) by the cache manager and where they reside in the cache.

Pointer to private cache map