Device Objects

Device objects are fundamental structures in Windows kernel-mode driver development. They represent a physical or logical device and are used by the operating system and drivers to interact with the hardware. Each device object is managed by the I/O Manager and is associated with a specific driver.

The Role of Device Objects

A device object serves as an interface between the operating system's I/O subsystem and the driver responsible for managing a device. When an application or another driver requests an operation on a device, the I/O Manager creates an I/O Request Packet (IRP) and sends it to the appropriate driver's dispatch routine, often through a device object.

Device Object Structure

The primary structure for a device object is DEVICE_OBJECT, defined in the wdm.h header file. This structure contains numerous fields that hold information about the device, including:

• DriverExtension: A pointer to the driver's device extension, a driver-defined structure used to store per-device context.
• NextDevice: A pointer to the next device object in the device tree.
• StackSize: The required stack size for IRPs sent to this device object.
• DeviceName: The name of the device object.
• Flags: Various flags that describe the characteristics and state of the device object.
• DeviceState: Information about the device's power state.

// Simplified representation of DEVICE_OBJECT structure
            typedef struct _DEVICE_OBJECT {
                CSHORT                       Type;
                CSHORT                       Size;
                // ... other fields ...
                PDEVICE_EXTENSION            DeviceExtension;
                struct _DEVICE_OBJECT        *NextDevice;
                USHORT                       StackSize;
                // ... more fields ...
            } DEVICE_OBJECT, *PDEVICE_OBJECT;

Creating and Managing Device Objects

Device objects are typically created by a driver's AddDevice routine. This routine is called by the Plug and Play (PnP) manager when a new instance of a device represented by the driver is detected. The driver then allocates memory for the device object and its device extension, initializes them, and attaches the device object to the device tree.

Types of Device Objects

• Physical Device Object (PDO): Represents a physical device on the system, such as a disk drive or a network card. PDOs are typically created by bus drivers.
• Functional Device Object (FDO): Represents a logical function or a device that has been enumerated. FDOs are usually created by function drivers.
• Filter Device Object: Used for filter drivers that intercept IRPs to modify or add functionality to the I/O path.

Device Object Attachment

Device objects are linked together to form a device tree. When a driver creates a device object, it typically attaches it to the device tree below the device object that represented its parent (e.g., a function driver attaches its FDO below the PDO created by the bus driver).

Further Reading

• The I/O Manager
• PDO and FDO
• Driver Objects