Device drivers and Windows

Question

I am trying to complete the picture of how the PC and the OS interacts together. And I am at point, where I am little out of guess when it comes to device drivers.

Please, don´t write things like its too complicated, or you don´t need to know when using high programming laguage and winapi functions. I want to know, it´s for study purposes.

So, the very basic structure of how OS and PC (by PC I mean of course HW) is how I see it is that all other than direct CPU commands, which can CPU do on itself (arithmetic operation, its registers access and memory access) must pass thru OS. Mainly becouse from ring level 3 you cannot use in and out intructions which are used for acesing other HW. I know that there is MMIO,but it must be set by port comunication first.

It was not like this all the time. Even I am bit young to remember MSDOS, I know you could access HW directly, becouse there ws no limitation, no ring mode. So you could to write string to diplay use wheather DOS function, or directly acess video card memory and write it by yourself.

But as OS developed, there is no longer this possibility. But it is fine, since OS now handles all the HW comunication, and frankly it more convinient and much more safe (I would say the only option) in multitasking environment. So nowdays you instead of using int instructions to use BIOS mapped function or DOS function you call dll which internally than handles everything you don´t need to know about.

I understand this. I also undrstand that device drivers is the piece of code that runs in ring level 0, so it can do all the HW interactions. But what I don´t understand is connection between OS and device driver. Let´s take a example - I want to make a sound card make a sound. So I call windows API to acess sound card, but what happens than? Does windows call device drivers to do so?

But if it does call device driver, does it mean, that all device drivers which can be called by winAPI function, must have routines named in some specific way? I mean, when I have new sound card, must its drivers have functions named same as the old one? So Windows can actually call the same function from its perspective? But if Windows have predefined sets of functions requored by device drivers, that it cannot use new drivers that doesent existed before last version of OS came out.

Please, help me understand this mess. I am really getting mad. Thanks.

Lorrinelorry

Answer 1

A Windows device driver is a bit like a DLL: except that instead of an application dynamic linking/loading it, it's the O/S that dynamic links/loads it.

Registry entries tell the O/S what device drivers exist (so that the O/S knows which device drivers to dynamic-link/load).

The device drivers run in ring 0. In ring zero, they (device drivers) don't have access to (can't link to or use) Windows APIs: instead they have access to various NT kernel APIs.

But if it does call device driver, does it mean, that all device drivers which can be called by winAPI function, must have routines named in some specific way? I mean, when I have new sound card, must its drivers have functions named same as the old one? So Windows can actually call the same function from its perspective?

Basically yes. All the device drivers within a given type or class (e.g. all video drivers, or all disk drivers) have a similar API, which is invoked by the O/S (and/or invoked by higher-level drivers, for example disk drivers are used/invoked by file system drivers).

The Windows Device Driver Kit defines the various APIs and includes sample drivers for the various types of device.

But if Windows have predefined sets of functions requored by device drivers, that it cannot use new drivers that doesent existed before last version of OS came out.

The O/S is dynamic-linking to the device driver functions: because device driver APIs are predefined, device drivers are interchangeable as far as the O/S is concerned; new device drivers can be written, provided they support (are backward-compatible with) the standard device driver API.

The dynamic-linking mechanism is very similar to the way in which COM objects or C++ classes implement any predefined pure-abstract interface: a header file in the DDK declares the pure-abstract interface (like virtual functions), device drivers implement these functions, and the O/S loads the drivers and invokes these functions.

Cranberry

Thanks, nice answer. Can I have one more? If I understand corectly, for devices "known" to OS, there is predefined set of function names and so that OS can call for example "get_sector()" function no matter which controller is used for HDD access (SCSI,SATA,ATA...). But If I have brand new device, what OS is not able manipulate with by WinAPI, can I still write drivers for it and than call them from my program? Thanks. – Lorrinelorry

@b-gen-jack-o-neill - Yes: Windows applications can use the DeviceIoControl function to send/receive arbitrary data to a device driver. – Cranberry

@Cranberry Very insightful indeed. However "The device drivers run in ring 0." - doesn't the Kernel only run in ring 0 and device drivers run in ring 1 and 2? – Archie

@Archie I quote en.wikipedia.org/wiki/Protection_ring#Privilege_level -- "It is not necessary to use all four privilege levels. Current operating systems with wide market share including Microsoft Windows, macOS, Linux, iOS and Android mostly use a paging mechanism with only one bit to specify the privilege level as either Supervisor or User (U/S Bit). Windows NT uses the two-level system." My answer was based on my experience of writing device drivers for Windows NT and so on in the 1990s. – Cranberry

Answer 2

The basics: Please note that this explanation is simplified and sometime only true for most cases and not all.

Most HW devices you will ever encounter will have these basic operations: Write to memory(or Registers) on them. Read from memory(or Registers) on them.

This is enough to control the HW, to give it the data it needs, and to get the data you want from it.

These memory areas are mapped by the BIOS and/or the OS to the Physical memory range on your PC (which may in turn be accessed by your driver.)

So we now have two operations READ and WRITE that the device driver knows to do.

In addition, the driver can read and write in a manner that does not involve the cpu. This is called Direct Memory Access (DMA) and usually performed by your HW.

The last type of operation is called INTERRUPTS and is meant for your HW to notify your driver of something that just happend. This is usually done by the HW interrupting the CPU and calling your driver to perform some operation in high priority. For example: an image is ready in the HW to be read by the driver.

Uund