Device Objects

Device objects represent a physical or logical device in a Windows system. They are fundamental to how the operating system interacts with hardware and are managed by the kernel-mode driver framework. Each device object encapsulates information about a device, including its properties, capabilities, and current state.

Overview

A device object, represented by the DEVICE_OBJECT structure, is created by a function driver or a filter driver when a device is detected or enumerated. This object serves as a handle for the system to refer to the device. It is crucial for managing I/O operations, power states, and other device-specific functionalities.

Key Components of a DEVICE_OBJECT:

Flags: A bitmask indicating various properties and states of the device object (e.g., DO_DEVICE_HAS_NAME, DO_LOW_PRIORITY_READ).
DriverExtension: A pointer to the DEVICE_OBJECT_EXTENSION structure, which provides additional driver-specific information.
NextDevice: A pointer to the next device object in the system's list of devices.
AttachedDevice: A pointer to the device object immediately above this one in the device stack (if any).
StackSize: The number of device objects in the device stack, including this one.
DeviceLock: A spin lock used to synchronize access to the device object.

Creating and Deleting Device Objects

Device objects are typically created using the IoCreateDevice function. This function allocates and initializes a DEVICE_OBJECT structure and associates it with a specific driver. The system-assigned device name is returned, which can be used by other components to access the device.

Note: The device name follows a specific naming convention, such as \Device\MyDeviceName.

When a device is removed or the driver is unloaded, the device object must be deleted using the IoDeleteDevice function. This frees up the resources associated with the device object and informs the system that the device is no longer available.

Device Stacks

Device objects are organized into device stacks. A device stack represents a layered communication path for I/O requests targeting a specific hardware device. The stack typically consists of a function driver at the bottom, followed by one or more filter drivers, and optionally a mídia driver at the top.

When an I/O request is issued for a device, it traverses the device stack. Each driver in the stack has an opportunity to process or modify the IRP before passing it down to the next lower driver or completing it.

Driver Roles in a Device Stack:

Function Driver: The primary driver responsible for managing the hardware device.
Filter Driver: A driver that intercepts I/O requests to modify them, add functionality, or perform monitoring. They can be lower or upper filters.
Média Driver: A driver that manages removable media (e.g., for disk drives).

Device Object Properties and Functionality

Device objects expose various properties and support different functionalities:

Naming: Device objects can be named or unnamed. Named devices allow applications and other drivers to open them directly.
PnP Capabilities: Device objects are integral to Plug and Play (PnP) operations, allowing the system to detect, configure, and manage devices dynamically.
Power Management: Device objects participate in the system's power management framework, enabling drivers to control device power states.
Interrupt Handling: Device objects are often associated with interrupt objects for handling hardware interrupts.

Example of accessing device object properties (Conceptual):


PDEVICE_OBJECT pDeviceObject = ...; // Obtained from IoCreateDevice or other means

// Check if the device has a name
if (pDeviceObject->Flags & DO_DEVICE_HAS_NAME) {
    // Access the device name
    UNICODE_STRING deviceName = pDeviceObject->DeviceName;
    // ... process device name ...
}

// Get the device extension
PVOID pDeviceExtension = pDeviceObject->DeviceExtension;
// ... use device extension for driver-specific data ...

Important: Proper management of device object creation, deletion, and manipulation is crucial for system stability and correct device operation. Incorrect handling can lead to memory leaks, crashes, or device malfunctions.

MSDN