How windows loads drivers

THE UNIVERSITY OF DODOMA

College Of Informatics and Virtual Education

NAME: Makame Hamza Makame REGISTRATION NO: T/UDOM/2010/00410 PROGRAM: B Sc. Computer and Information Security

ASSIGNMENT NO. 1

COURSE NAME: Operating Systems COURSE CODE: CS 203 COUSE INSTRUCTOR: Dr. Msele

Question: Write Short notes on how Drives are loaded in Windows, Linux or UNIX.

Tuesday, April 03, 2012

Introduction A driver is a computer program allowing higher-level computer programs to interact with a hardware device. Before any operating system completes boot up, drives must be loaded.

These drivers are loaded depending on various priorities type such as driver start type and driver load order groups.

Driver Start Types

There are five start types: SERVICE_BOOT_START (0x00000000): Indicates a driver started by the operating system (OS) loader SERVICE_SYSTEM_START (0x00000001): Indicates a driver started during OS initialization. This start type is used by the file system recognizer. Except for the file systems listed below under "SERVICE_DISABLED," file systems (including network file system components) commonly use this start type or SERVICE_DEMAND_START. This start type is also used by device drivers for PnP devices that are enumerated during system initialization but not required to load the system.

SERVICE_AUTO_START (0x00000002) Indicates a driver started by the Service Control Manager during system startup. Rarely used.

SERVICE_DEMAND_START (0x00000003) Indicates a driver started on demand, either by the PnP Manager (for device drivers) or by the Service Control Manager (for file systems and file system filter drivers).

SERVICE_DISABLED (0x00000004) Indicates a driver that is not started by the OS loader, Service Control Manager, or PnP Manager. Used by file systems that are loaded by a file system recognizer or by another file system. Also used to temporarily disable a driver during debugging.

Driver Load Order Groups Within the SERVICE_BOOT_START and SERVICE_SYSTEM_START start types, the relative order in which drivers are loaded is specified by each driver's load order group.

Drivers whose start type is SERVICE_BOOT_START are called boot (or boot-start) drivers. On Microsoft Windows 2000 and earlier systems, most filters that are boot drivers belong to the "filter" group. On Microsoft Windows XP and later systems, filters that are boot drivers generally belong to one of the new FSFilter load order groups.

Tuesday, April 03, 2012

Driver whose start type is SERVICE_SYSTEM_START are also loaded in the order of the load order groups to which they belong. However, no system-start driver is loaded until after all boot drivers have been loaded.

How Drivers are loaded.

File systems are initialized during the system boot process; specifically, during I/O system initialization. The I/O Manager creates the global file system queue and initializes the file system and filter drivers that were loaded by the operating system (OS) loader and the PnP Manager.

The following are portions of the system boot process that are of interest to file system and filter driver developers.

1. During system boot, the OS loader loads the boot file system, the RAW file system, and all drivers of type SERVICE_BOOT_START before the loader transfers control to the kernel.

These drivers are in memory when the kernel gets control.

Drivers are loaded in order of the load order groups to which they are assigned. Among file system filters, those that are assigned to one of the new file system filter driver load order groups are loaded before all other filter drivers.

Then all drivers in the "filter" load order group are loaded.

2. The I/O Manager creates a global file system queue with four segments, one each for CDROM, disk, tape devices, and network file systems. Later, when each file system is registered, its control device objects are added to the appropriate segments of this queue. At this point, however, no file systems have yet been registered, so the queue is empty.

3. The PnP Manager calls the DriveEntry routines of the RAW file system and all SERVICE_BOOT_START drivers.

If a SERVICE_BOOT_START driver is dependent on other drivers, those drivers are loaded and started as well.

The PnP Manager starts the boot devices by calling the AddDevice routines of the boot device drivers. If a boot device has child devices, those devices are enumerated. The child devices are also configured and started if their drivers are boot-start drivers. If a device's drivers are not all boot-start drivers, the PnP Manager creates a devnode for the device but does not start the device.

At this point, all boot drivers are loaded and the boot devices are started.

4. The PnP Manager traverses the PnP device tree, locating and loading the drivers that are associated with each devnode but not already running.

When each PnP device starts, the PnP Manager enumerates the children of the device, if any. The PnP Manager configures the child devices, loads their device drivers, and starts the devices.

Tuesday, April 03, 2012

The PnP Manager loads each device's drivers regardless of the drivers' StartType, LoadOrderGroup, or Dependencies values.

In this step, the PnP Manager only configures and starts devices that are PnPenumerable. If a device is not PnP-enumerable, the PnP Manager ignores the device and does not enumerate its children, even if the child devices are PnP-enumerable.

5. The PnP Manager loads and initializes drivers of type SERVICE_SYSTEM_START that are not yet loaded.

The file system recognizer (FsRec) is loaded at this time. Note that, although it is in the "Boot File System" load order group, FsRec is not the boot file system. The actual boot file system − that is, the file system that mounted the boot volume − is loaded at the start of the boot process.

Later in the SERVICE_SYSTEM_START phase, file systems in the "File System" load order group are loaded. This includes the Named Pipe File System (NPFS) and Mailslot File System (MSFS). It does not include media-based file systems, such as NTFS, FAT, CDFS, or UDFS. Network file systems, which are in the "Network" load order group, are also loaded during this phase.

6. After all drivers that load at boot time have been initialized, the I/O Manager calls the reinitialization routines of any drivers that have them. A reinitialization routine is a callback routine that is registered by a boot driver that needs to be given additional processing time at this point in the boot process. Reinitialization routines are registered by calling IoRegisterBootDriverReinitialization or IoRegisterDriverReinitialization.

7. The Service Control Manager loads drivers of type SERVICE_AUTO_START that are not already loaded Conclusion This is how drivers are loaded in the Windows Operating System, depending on their Start types and load order groups.

References http//msdn.microsoft.com/en-us/windows/hardware

Tuesday, April 03, 2012