Kernel Architecture
This section discusses the kernel mode infrastructure provided by Windows, its key architectural features, components and mechanisms. It covers details of threading model, virtual address space, native API calls, handle table, object management and exception handling from the kernel’s perspective. Attendees will learn about the similarities and differences between the user mode and kernel mode environment in Windows and their implications on development and debugging.
Kernel Execution Environment
Unlike user mode where executable code runs only in the context of an application thread, driver code can run under various contexts like ISRs, DPCs, APCs, system worker threads and user mode threads. This section focuses on these different execution environments and discusses the restrictions that apply to each one of them. Attendees will learn about the usage model of these environments and how to avoid common pitfalls associated with them.
Kernel Synchronization
The windows kernel provides quite a few synchronization mechanisms like events, semaphores, mutexes, ERESOURCEs and spin locks to driver developers. This section covers these mechanisms, highlights the key differences between them and discusses the design tradeoffs. Data structures used to implement these mechanisms and the debugger commands that apply to these structures are discussed with the intention of familiarizing attendees with their usage in debugging deadlocks and livelocks.
Memory Management
As compared to user mode applications, drivers can exercise far more control over memory allocation and usage. This section covers some of the key concepts related to kernel mode memory management. It discusses the layout of the system virtual address space, page table entries for X86, X64 and ARM, the PFN database, MDLs, kernel memory pools and look-aside lists. Attendees will gain a solid understanding of behind the scenes implementation of the kernel memory management APIs and how to use them effectively in device drivers.
I/O Management
Device drivers interact with the I/O manager using data structures like driver objects, device objects (FDO, PDO, FiDO), symbolic links, file objects and I/O request packets. This section provides an architectural overview of these structures, their mutual relationships and how they are used by drivers to implement driver functionality like PnP, data transfer between user mode and kernel mode, Synchronous & Asynchronous I/O processing, I/O completion, I/O cancellation and I/O request filtering. Attendees will learn how to interpret the information displayed by the debugger commands and use that to gather information about device drivers and I/O operations in the system.
