1. Creating User-Mode Drivers with a Proxy (or How to Look Smarter Than You Really Are)
Galen C. Hunt
Microsoft Research
and the University of Rochester
Department of Computer Science
Writing NT drivers is intellectually challenging.
My first experience in creating an NT driver was an attempt to make an HTTP file system driver. To the system, it made data on remote HTTP data appear as local files.
Managing remote HTTP connections from kernel mode in a file system driver was more than I had the stomach for.

2. Problem NT Drivers Difficulties: Kernel-Mode Environment:
Minimal (12K) Stack,
Paged and Non-Paged Memory Pools,
Crashes are Globally Fatal,
Two (2) Machines for Debugging.
Packet-Driven I/O Model:
Fully re-entrant code,
Take extreme care when blocking.
Two factors make creating NT driver difficult: the environment and the model.
NT drivers operate in the kernel environment.
They have access to a limited stack (12K),
They must carefully decide which resources belong in core and which may be paged.
When a driver crashes in crashes the entire system
and one typically needs two machines to debug a driver: one for the driver and one for the debugger.
Another difficult is the fact that the NT I/O model is packet-event driven. Drivers must be fully re-entrant and must take extreme care when blocking.
15-May-19

3. Solution Write User-Mode Device Drivers.
Use Proxy for a Kernel-Mode Presence.
My solution to managing the challenge of create NT drivers is to move the driver into user-mode.
Because drivers provide services to the NT kernel, they must have a kernel-mode presence.
The primary contribution of this work is a proxy driver that provides a kernel-mode presence for user-mode drivers.
15-May-19

4. Outline NT Driver & Proxy Architecture Implementation Details
Introduction
Outline
NT Driver & Proxy Architecture
Implementation Details
Performance Measurements
Related Work
Conclusions
I’ve provided a motivation for this work.
Next I will cover the NT driver architecture in general and the architecture of the proxy driver in particular.
I will then describe the implementation of the proxy driver in more detail, present some performance results and describe related work as time permits.

5. NT Kernel-Mode I/O Architecture
I/O Manager
= I/O Request Packet
Crypto
- Filter Driver
NTFS
- File-System Driver
Stripe (RAID)
- Intermediate Driver
The NT I/O architecture follows a packet-oriented, layered model. At the top is the I/O manager which converts API calls into I/O request packs: IRPs.
SCSI
- Port Driver
Adaptec
- Miniport (Adapter) Driver

6. Kernel-Mode Driver Architecture
Application and
Win32 Subsystem
User Mode
APIs
NT Executive
(I/O Manager)
Kernel Mode
IRPs
Device Entry
Device Driver

7. Proxy Driver Architecture
App. &
Win32
User-Mode Driver
User Mode
COM
COM Service
APIs
APIs
NT I/O Manager
Kernel Mode
IRPs
Stub Entry
Host Entry
IRPs
Proxy Driver

8. Proxy Details 1 App. & Win32 User-Mode Driver COM Service
NT I/O Manager
Stub Entry
Host Entry
1. COM Service makes API Read call
Proxy Driver

9. Proxy Details 2 App. & Win32 User-Mode Driver COM Service 1
NT I/O Manager 2
Stub Entry
Host Entry
2. I/O Manager converts call to an IRP and post through the proxy device entry.
Proxy Driver

10. Proxy Details 3 App. & Win32 User-Mode Driver COM Service 1
NT I/O Manager 2
Stub Entry
Host Entry
3. Proxy driver places IRP in transport queue and marks as pending.
Proxy Driver 3

11. Proxy Details App. & Win32 User-Mode Driver COM Service 4 1
NT I/O Manager 2
Stub Entry
Host Entry
4. Application makes API call.
Proxy Driver 3

12. Proxy Details 5 App. & Win32 User-Mode Driver COM Service 4 1
NT I/O Manager 5 2
Stub Entry
Host Entry
5. I/O Manager converts call to an IRP and posts through the stub device entry.
Proxy Driver 3

13. Proxy Details 6 App. & Win32 User-Mode Driver COM Service 4 1
NT I/O Manager 5 2
Stub Entry
Host Entry
6. Proxy driver places IRP in request queue and marks as pending.
Proxy Driver 6 3

14. Proxy Details 7 App. & Win32 User-Mode Driver COM Service 4 1
NT I/O Manager 7 5 2
Stub Entry
Host Entry
7. Driver removes one request and one transport IRP from each queue, writes request into transport IRP’s buffer and completes transport IRP.
Proxy Driver 6 3

15. Proxy Details 8 App. & Win32 User-Mode Driver COM Service 4 1
NT I/O Manager 7 5 2
Stub Entry
Host Entry
8. COM Service calls user-mode driver through IDeviceFileSink
Proxy Driver 6 3

16. Proxy Details 9 App. & Win32 User-Mode Driver 8 COM Service 4 1
NT I/O Manager 7 5 2
Stub Entry
Host Entry
9. User-mode driver processes request and returns.
Proxy Driver 6 3

17. Proxy Details 10 App. & Win32 User-Mode Driver 9 8 COM Service 4 1
NT I/O Manager 7 5 2
Stub Entry
Host Entry
10. COM Service makes API Write call to return response. 10
Proxy Driver 6 3

18. Proxy Details 11 App. & Win32 User-Mode Driver 9 8 COM Service 4 1
NT I/O Manager 7 5 2
Stub Entry
Host Entry
11. Proxy driver completes application request IRP. 10
Proxy Driver 6 3

19. Proxy Details Summary 9 8 1 4 11 5 2 7 10 6 3 App. & Win32
User-Mode Driver 9
COM Service 8 1 4
NT I/O Manager 11 5
Stub Entry
Host Entry 2 7
1. COM Service makes API Read call
2. I/O Manager converts call to an IRP and post through the proxy device entry.
3. Proxy driver places IRP in transport queue and marks as pending.
4. Application makes API call.
5. I/O Manager converts call to an IRP and posts through the stub device entry.
6. Proxy driver places IRP in request queue and marks as pending.
7. Driver removes one request and one transport IRP from each queue, writes request into transport IRP’s buffer and completes transport IRP.
8. COM Service calls user-mode driver through IDeviceFileSink
9. User-mode driver processes request and returns.
10. COM Service makes API Write call to return response.
11. Proxy driver completes application request IRP. 10
Proxy Driver 6 3

20. Null (Raw) Device Latency
= 14s

21. Raw Device Throughput

22. RamDisk Throughput

23. File-System Write Throughput

24. Related Work Watchdogs [Bershad & Pinkerton, 1988]
Semantic File System [Gifford et al, 1991]
HURD Translators [Bushnell, 1994]
Frigate [Kim and Popek, 1997]
Rialto [Draves and Cutshall, 1997]

25. Conclusion Drivers Create with Proxy include: HTTP/FTP File System
Virtual Memory Disk
Further Information:

26. Appendix A: IDeviceFileSink
interface IDeviceFileSink : IUnknown {
HRESULT Create ([in] IDevIrp *pIrp,
[in] IDevSecurityContext *pCtxt,...
HRESULT Cleanup ([in] IDevIrp *pIrp);
HRESULT Close ([in] IDevIrp *pIrp);
HRESULT Shutdown ([in] IDevIrp *pIrp);
HRESULT Read ([in] IDevIrp *pIrp,
[in] LARGE_INTEGER ByteOffset,...
HRESULT Write ([in] IDevIrp *pIrp,
HRESULT DeviceControl ([in] IDevIrp *pIrp,
[in] ULONG IoControlCode,...
HRESULT QueryInformation([in] IDevIrp *pIrp,
[in] ULONG Length,...
HRESULT SetInformation ([in] IDevIrp *pIrp,
HRESULT FlushBuffers ([in] IDevIrp *pIrp); };