[QUESTION] Difference Driver Stacks and Device Stacks

x BlueRobot · Jul 24, 2013

I've been reading this link by Microsoft explaining Device Stacks and Driver Stacks, but I can't seem to fully understand the differences since they seem to be so similar - Device nodes and device stacks (Windows Drivers)

From what I understand, a driver stack is all the individual driver types which make up one device driver, such as the filter driver etc.

However, a device stack is either device stack is a list of ordered device objects, or a ordered list of driver objects, it's hard to understand when they can be interchangeable :huh:

I understand a device node is meant to represent a physical device within the device tree.

Vir Gnarus · Jul 24, 2013

Driver stacks.

Device stack is a list of device objects associated with a device node, and of course each device object associated with a driver. While this may seem to mean that device stack = driver stack, a good bit of IRPs are serviced by multiple device stacks, of which a particular driver may be servicing an IRP through an FDO in one device stack and through a PDO in another. This is accomplished because a single driver can access multiple device objects, it's not associated with just one. So while an IRP may pass through several device objects in one or more device stacks, it can end up being serviced by just a couple drivers. That's where the disparity happens between a device stack and a driver stack; you're looking at the same I/O but through either a device object perspective or a driver perspective.

Take the following as an example:

Code:

2: kd> !irp fffffa800d012010
Irp is active with 12 stacks 12 is current (= 0xfffffa800d0123f8)
 No Mdl: No System Buffer: Thread fffffa800bbf09e0:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

            Args: 00000000 00000000 00000000 00000000
>[  0, 0]   0  0 fffffa800c6e9060 fffffa800b8b2d20 00000000-00000000    
           \Driver\cbfs3
            Args: fffff88020ef6728 01004021 00070000 00000000

2: kd> !drvobj \Driver\cbfs3 1
Driver object (fffffa80079b9720) is for:
 \Driver\cbfs3
Driver Extension List: (id , addr)

Device Object list:
fffffa800ca9a530  fffffa800cf2e040  fffffa800cb05040  fffffa800b0c1040
fffffa800c6f1780  fffffa800bc33900  fffffa800c6e9060  fffffa800c670060
fffffa800c562c20  fffffa800c680ad0  fffffa800c621940  fffffa800c6e9e10
fffffa800c6eae10  fffffa800c5b0960  fffffa800c51fe10  fffffa800c651660
fffffa800c6d5cc0  fffffa800c6d0a80  fffffa80079bc730  fffffa80079bc950
fffffa80079bc060  fffffa80079b8440  fffffa80079b8060  fffffa80079b8900

Cbfs3 is for a virtual filesystem/disk software that a particular client was using. When looking at the driver, you can see that it has a lot of device objects associated with it! This is a prime example how the relation between driver objects and device objects isn't exactly 1:1.

x BlueRobot · Jul 24, 2013

Thank you as always :thumbsup2:

Search

Search

[QUESTION] Difference Driver Stacks and Device Stacks

x BlueRobot

Administrator

Vir Gnarus

BSOD Kernel Dump Expert

x BlueRobot

Administrator