Creating User-Mode Drivers with a Proxy (or How to Look Smarter Than You Really Are) Galen C. Hunt Microsoft Research and the University of Rochester Department of Computer Science Writing NT drivers is intellectually challenging. My first experience in creating an NT driver was an attempt to make an HTTP file system driver. To the system, it made data on remote HTTP data appear as local files. Managing remote HTTP connections from kernel mode in a file system driver was more than I had the stomach for.

Problem NT Drivers Difficulties: Kernel-Mode Environment: Minimal (12K) Stack, Paged and Non-Paged Memory Pools, Crashes are Globally Fatal, Two (2) Machines for Debugging. Packet-Driven I/O Model: Fully re-entrant code, Take extreme care when blocking. Two factors make creating NT driver difficult: the environment and the model. NT drivers operate in the kernel environment. They have access to a limited stack (12K), They must carefully decide which resources belong in core and which may be paged. When a driver crashes in crashes the entire system and one typically needs two machines to debug a driver: one for the driver and one for the debugger. Another difficult is the fact that the NT I/O model is packet-event driven. Drivers must be fully re-entrant and must take extreme care when blocking. 15-May-19

Solution Write User-Mode Device Drivers. Use Proxy for a Kernel-Mode Presence. My solution to managing the challenge of create NT drivers is to move the driver into user-mode. Because drivers provide services to the NT kernel, they must have a kernel-mode presence. The primary contribution of this work is a proxy driver that provides a kernel-mode presence for user-mode drivers. 15-May-19

Outline NT Driver & Proxy Architecture Implementation Details Introduction Outline NT Driver & Proxy Architecture Implementation Details Performance Measurements Related Work Conclusions I’ve provided a motivation for this work. Next I will cover the NT driver architecture in general and the architecture of the proxy driver in particular. I will then describe the implementation of the proxy driver in more detail, present some performance results and describe related work as time permits.

NT Kernel-Mode I/O Architecture I/O Manager = I/O Request Packet Crypto - Filter Driver NTFS - File-System Driver Stripe (RAID) - Intermediate Driver The NT I/O architecture follows a packet-oriented, layered model. At the top is the I/O manager which converts API calls into I/O request packs: IRPs. SCSI - Port Driver Adaptec - Miniport (Adapter) Driver

Kernel-Mode Driver Architecture Application and Win32 Subsystem User Mode APIs NT Executive (I/O Manager) Kernel Mode IRPs Device Entry Device Driver

Proxy Driver Architecture App. & Win32 User-Mode Driver User Mode COM COM Service APIs APIs NT I/O Manager Kernel Mode IRPs Stub Entry Host Entry IRPs Proxy Driver

Proxy Details 1 App. & Win32 User-Mode Driver COM Service NT I/O Manager Stub Entry Host Entry 1. COM Service makes API Read call Proxy Driver

Proxy Details 2 App. & Win32 User-Mode Driver COM Service 1 NT I/O Manager 2 Stub Entry Host Entry 2. I/O Manager converts call to an IRP and post through the proxy device entry. Proxy Driver

Proxy Details 3 App. & Win32 User-Mode Driver COM Service 1 NT I/O Manager 2 Stub Entry Host Entry 3. Proxy driver places IRP in transport queue and marks as pending. Proxy Driver 3

Proxy Details App. & Win32 User-Mode Driver COM Service 4 1 NT I/O Manager 2 Stub Entry Host Entry 4. Application makes API call. Proxy Driver 3

Proxy Details 5 App. & Win32 User-Mode Driver COM Service 4 1 NT I/O Manager 5 2 Stub Entry Host Entry 5. I/O Manager converts call to an IRP and posts through the stub device entry. Proxy Driver 3

Proxy Details 6 App. & Win32 User-Mode Driver COM Service 4 1 NT I/O Manager 5 2 Stub Entry Host Entry 6. Proxy driver places IRP in request queue and marks as pending. Proxy Driver 6 3

Proxy Details 7 App. & Win32 User-Mode Driver COM Service 4 1 NT I/O Manager 7 5 2 Stub Entry Host Entry 7. Driver removes one request and one transport IRP from each queue, writes request into transport IRP’s buffer and completes transport IRP. Proxy Driver 6 3

Proxy Details 8 App. & Win32 User-Mode Driver COM Service 4 1 NT I/O Manager 7 5 2 Stub Entry Host Entry 8. COM Service calls user-mode driver through IDeviceFileSink Proxy Driver 6 3

Proxy Details 9 App. & Win32 User-Mode Driver 8 COM Service 4 1 NT I/O Manager 7 5 2 Stub Entry Host Entry 9. User-mode driver processes request and returns. Proxy Driver 6 3

Proxy Details 10 App. & Win32 User-Mode Driver 9 8 COM Service 4 1 NT I/O Manager 7 5 2 Stub Entry Host Entry 10. COM Service makes API Write call to return response. 10 Proxy Driver 6 3

Proxy Details 11 App. & Win32 User-Mode Driver 9 8 COM Service 4 1 NT I/O Manager 7 5 2 Stub Entry Host Entry 11. Proxy driver completes application request IRP. 10 Proxy Driver 6 3

Proxy Details Summary 9 8 1 4 11 5 2 7 10 6 3 App. & Win32 User-Mode Driver 9 COM Service 8 1 4 NT I/O Manager 11 5 Stub Entry Host Entry 2 7 1. COM Service makes API Read call 2. I/O Manager converts call to an IRP and post through the proxy device entry. 3. Proxy driver places IRP in transport queue and marks as pending. 4. Application makes API call. 5. I/O Manager converts call to an IRP and posts through the stub device entry. 6. Proxy driver places IRP in request queue and marks as pending. 7. Driver removes one request and one transport IRP from each queue, writes request into transport IRP’s buffer and completes transport IRP. 8. COM Service calls user-mode driver through IDeviceFileSink 9. User-mode driver processes request and returns. 10. COM Service makes API Write call to return response. 11. Proxy driver completes application request IRP. 10 Proxy Driver 6 3

Null (Raw) Device Latency = 14s

Raw Device Throughput

RamDisk Throughput

File-System Write Throughput

Related Work Watchdogs [Bershad & Pinkerton, 1988] Semantic File System [Gifford et al, 1991] HURD Translators [Bushnell, 1994] Frigate [Kim and Popek, 1997] Rialto [Draves and Cutshall, 1997]

Conclusion Drivers Create with Proxy include: HTTP/FTP File System Virtual Memory Disk Further Information: http://research.microsoft.com/~galenh/proxy

Appendix A: IDeviceFileSink interface IDeviceFileSink : IUnknown { HRESULT Create ([in] IDevIrp *pIrp, [in] IDevSecurityContext *pCtxt,... HRESULT Cleanup ([in] IDevIrp *pIrp); HRESULT Close ([in] IDevIrp *pIrp); HRESULT Shutdown ([in] IDevIrp *pIrp); HRESULT Read ([in] IDevIrp *pIrp, [in] LARGE_INTEGER ByteOffset,... HRESULT Write ([in] IDevIrp *pIrp, HRESULT DeviceControl ([in] IDevIrp *pIrp, [in] ULONG IoControlCode,... HRESULT QueryInformation([in] IDevIrp *pIrp, [in] ULONG Length,... HRESULT SetInformation ([in] IDevIrp *pIrp, HRESULT FlushBuffers ([in] IDevIrp *pIrp); };