windows驱动理解（二）

Device drivers
设备驱动
Although device drivers are explained in detail in Chapter 6, this section provides a brief overview of the types of drivers and 
虽然设备驱动会被详尽说明在第6章，这个章节提供一个简单的概述（有关驱动的） 和
explains how to list the drivers installed and loaded on your system.
说明怎么去列出被安装的驱动（在你的系统中）
Windows supports kernel-mode and user-mode drivers, but this section discussed the kernel drivers only. The term device driver
windows提供核心模式和用户模式驱动，但是这个章节只讨论核心驱动。这个术语 设备驱动

 implies a hardware device, but there are other device driver types that are not directly related to hardware (listed momentarily). 
暗示了一个硬件设备，但是有其他设备类型，这些设备类型不直接和硬件相关。
This section focuses on device drivers that are related to controlling a hardware device.
这个章节聚焦设备驱动，这些设备驱动和控制一个硬件设备有关。
Device drivers are loadable kernel-mode modules (files typically ending with the .sys extension) that interface between the I/O
设备驱动被加载到核心模式的模块（通常以.sys扩展名结尾的），设备驱动在I/O管理器和相关的硬件中存在。

 manager and the relevant hardware. They run in kernel mode in one of three contexts:
他们运行在核心模式下。在以下3种上下文中。

In the context of the user thread that initiated an I/O function (such as a read operation)

在这种上下文中，用户的线程是被初始化I/O工程。像一个读操作符。
In the context of a kernel-mode system thread (such as a request from the Plug and Play manager)

在有关核心模式系统线程的上下文中。
As a result of an interrupt and therefore not in the context of any particular thread but rather of whichever thread was current when the interrupt occurred
作为一个结果，中断并且因此不在上下文有关任何特别线程 当中断发生，无论当时是什么线程

As stated in the preceding section, device drivers in Windows don’t manipulate hardware directly. Rather, they call functions in
像之前章节说明一样，设备驱动在windos中不会直接操作硬件。他们调用在hal的功能去硬件接口
 the HAL to interface with the hardware. Drivers are typically written in C and/or C++. Therefore, with proper use of HAL routines,
驱动通常被写成c或c++。因此，在hal的合理应用下
 they can be source-code portable across the CPU architectures supported by Windows and binary portable within an architecture
他们被移植成跨各种cpu架构，通过windows系统的支持。也可以是2进制移植代码在架构的大家庭中。
 family.
There are several types of device drivers:
有多种设备驱动
Hardware device drivers These use the HAL to manipulate hardware to write output to or retrieve input from a physical device or
硬件设备驱动。用HAL去操作去写输出或者接受输入，从一个物理设备或者网络。
 network. There are many types of hardware device drivers, such as bus drivers, human interface drivers, mass storage drivers, and
            有许多类型的硬件设备驱动，像总线，人类接口设备，大存储设备驱动等等。

 so on.
File system drivers These are Windows drivers that accept file-oriented I/O requests and translate them into I/O requests bound 
文件设备驱动。 接收文件对象的I/o请求并且转化IO请求被绑定在特殊的设备中
for a particular device.
File system filter drivers These include drivers that perform disk mirroring and encryption or scanning to locate viruses, intercept 
文件系统过滤驱动。  包括执行磁盘监控的驱动，加密扫描病毒的。拦截IO请求
I/O requests, and perform some added-value processing before passing the I/O to the next layer (or in some cases rejecting the 
并且执行一些”加值“操作，然后发去下一层。
operation).
Network redirectors and servers These are file system drivers that transmit file system I/O requests to a machine on the network
网络重定向和服务。  文件系统的驱动可以传输文件系统的IO请求 到大型机器上。这个可以在网络线路中，也可以是接受这样的请求。
 and receive such requests, respectively.
Protocol drivers These implement a networking protocol such as TCP/IP, NetBEUI, and IPX/SPX. 
协议驱动，这些实现一个网络协议像TCP/IP协议。。 

Kernel streaming filter drivers  These are chained together to perform signal processing on data
     核心流驱动             这些驱动是被链接在一起去执行信号的处理有关数据流                            

streams, such as recording or displaying audio and video.

Software drivers These are kernel modules that perform operations that can only be done in kernel mode on behalf of some 
软件驱动，这些是内核模块，可以执行操作，仅限在内核模式，但是用的却是用户模式
user-mode process. Many utilities from Sysinternals such as Process Explorer and Process Monitor use drivers to get information
                                 许多工具像 PROCESS EXPlorer使用的驱动不可能在用户模式下使用。
 or perform operations that are not possible to do from user-mode APIs.

Windows driver model
windows驱动模型
The original driver model was created in the first NT version (3.1) and did not support the concept of Plug and Play (PnP) because
这个原始的驱动模型被创造在第一个NT版本，3.1。并且不支持这个PNP概念因为那还是不可行的。
 it was not yet available. This remained the case until Windows 2000 came along (and Windows 95/98 on the consumer Windows 
                                  一直到windows2000
side).
Windows 2000 added support for PnP, Power Options, and an extension to the Windows NT driver model called the Windows 
windo2000被加入 pnp功能。  电源选项 和一个拓展 windows NT驱动模型被叫做windows 驱动模型。
Driver Model (WDM). Windows 2000 and later can run legacy Windows NT 4 drivers, but because these don’t support PnP and
             windows2000和之后的版本可以运行传统windowsNT 4驱动，但是不支持PNP和
 Power Options, systems running these drivers will have reduced capabilities in these two areas.

电源操作，系统运行这个驱动将降低兼容性
Originally, WDM provided a common driver model that was (almost) source compatible between Windows 2000/XP and Windows
起初，WDM提供一个普通的驱动模型，这个模型xp和98完成兼容。
 98/ME. This was done to make it easier to write drivers for hardware devices, since a single code base was needed instead of two.
           这样做使它能简单写驱动给硬件设备，因为一份代码总比两份代码简单。
 WDM was simulated on Windows 98/ME. Once these operating systems were no longer used, WDM remained the base model 
WDM被模仿像在windows98一样。一旦这些操作系统不再被使用，WDM保留这个基础的模型为了写
for writing drivers for hardware devices for Windows 2000 and later versions.
驱动给硬件设备，这样可以在2000和之后的版本也能运行。
From the WDM perspective, there are three kinds of drivers:
从WDM的视角，有3个种类的驱动。
Bus drivers A bus driver services a bus controller, adapter, bridge, or any device that has child devices. Bus drivers are required 
总线驱动，一个总线驱动服务一个总线控制器，适配器，桥或者设备。这类设备都有子设备。                         总线设备需要驱动的支持
drivers, and Microsoft generally provides them. Each type of bus
           微软通常提供它们。

(such as PCI, PCMCIA, and USB) on a system has one bus driver. Third parties can write bus drivers to provide support for new buses, such as VMEbus, Multibus, and Futurebus.
像PCI，PCMCIA 和usb。在系统上的总线类型有一个总线驱动。第三方可以写总线驱动然后提供支持给新的总线像VMEbus

Function drivers A function driver is the main device driver and provides the operational interface for its device. It is a required 
功能驱动。一个功能驱动是这个主要的设备驱动并且提供可操作的接口给它的设备。它是一个被需要
driver unless the device is used raw, an implementation in which I/O is done by the bus driver and any bus filter drivers, such as 
设备除非这个设备原始使用，一个实现：输入输出由总线驱动和总线过滤驱动完成
SCSI PassThru. A function driver is by definition the driver that knows the most about a particular device, and it is usually the only
                    一个功能驱动是被定义，这个驱动知道特别的设备，就它知道访问特别设备的寄存器。
 driver that accesses device-specific registers.

Filter drivers A filter driver is used to add functionality to a device or existing driver, or to modify I/O requests or responses from 过滤驱动，一个过滤驱动被使用， 然后就能加入功能，然后设备或者存在的驱动就有了新的功能。或者修改IO需求或者响应，它们来自其他的驱动
other drivers. It is often used to fix hardware that provides incorrect information about its hardware resource requirements. Filter
                          过滤驱动经常被使用去修付硬件，就可以提供正确的信息，这些信息是硬件的资源需求。
drivers are optional and can exist in any number, placed above or below a function driver and above a bus driver. Usually, system 过滤驱动可以被选并且是任意数量，被放置在一个功能驱动的上层或者下层。并且在总线驱动之上。一般的，系统
original equipment manufacturers (OEMs) or independent hardware vendors (IHVs) supply filter drivers.
原始装备制造商或者硬件供应商供应过滤驱动
In the WDM driver environment, no single driver controls all aspects of a device. A bus driver is concerned with reporting the 在WDM驱动环境，没有单个驱动控制一个设备所有的方面。一个总线驱动被考虑
devices on its bus to PnP manager, while a function driver manipulates the device.
向pnp管理器报告总线上设备，功能驱动操作这个设备。
In most cases, lower-level filter drivers modify the behavior of device hardware. For example, if a device reports to its bus driver 
  大多数情况下，低级的过滤驱动修改行为--设备硬件的行为。例如，一个设备向它的总线驱动打报告，
that it requires 4 I/O ports when it actually requires 16 I/O ports, a lower- level, device-specific function filter driver could 
它要4个输入输出端口，但是它实际要16个输入输出端口。低层的设备说明功能过滤驱动能解释
intercept the list of hardware resources reported by the bus driver to the PnP manager and update the count of I/O ports.
硬件资源列表通过总线驱动 （这个列表被报告到PNP管理器通过总线驱动）        并且更新输入输出端口的计数
Upper-level filter drivers usually provide added-value features for a device. For example, an upper- level device filter driver for a 

高级的过滤驱动通常给一个设备提供加值功能。比如一个高级设备过滤驱动可以给一个磁盘提供附加的安全检查。
disk can enforce additional security checks.

Interrupt processing is explained in Chapter 8 in Part 2 and in the narrow context of device drivers, in Chapter 6. Further details 
中断进程被解释在第八章，并且
about the I/O manager, WDM, Plug and Play, and power management are also covered in Chapter 6.
Windows Driver Foundation

The Windows Driver Foundation (WDF) simplifies Windows driver development by providing two frameworks: the Kernel-Mode
这个WDF简述了windows驱动开发用两个框架。核心框架和用户框架
 Driver Framework (KMDF) and the User-Mode Driver Framework (UMDF). Developers can use KMDF to write drivers for Windows                                                                                                                    开发者可以使用核心框架去写驱动
2000 SP4 and later, while UMDF supports Windows XP and later.
                              同时umdf支持xp和往后的版本
KMDF provides a simple interface to WDM and hides its complexity from the driver writer without modifying the underlying kmdf提供一个简单的接口，给到wdm并且隐藏它的复杂性，让驱动写入者不用去修改底层总线功能模型
bus/function/filter model. KMDF drivers respond to events that they can register and call into the KMDF library to perform work                                        核心框架驱动响应事件--这个事件可以被注册和调用到核心驱动框架库去执行工作--这个工作
that isn’t specific to the hardware they are managing, such as generic power management or synchronization. (Previously, each 
不是硬件负责管理。像普通的电源管理或者同步
driver had to implement this on its own.) In some cases, more than 200 lines of WDM code can be replaced by a single KMDF 
之前每个驱动要实现电源管理靠他们自己           某些情况200行代码可以被代替用一个kmdf调用
function call.

UMDF enables certain classes of drivers—mostly USB-based or other high-latency protocol buses, such as those for video 
umdf  让某类驱动  可行，，，，           大多数usb后者其他高延迟协议总线。比如给视频摄像头，MP3，手机
cameras, MP3 players, cell phones, and printers—to be implemented as user- mode drivers. UMDF runs each user-mode driver in 
                                                                             用用户模式驱动执行。umdf运行每个用户模式驱动
what is essentially a user-mode service, and it uses ALPC to communicate to a kernel-mode wrapper driver that provides actual 
   本质上是一个用户模式的服务，它用alpc去交流，和核心包装的驱动-----这个核心包装驱动提供真权限去访问硬件。
access to hardware. If a UMDF driver crashes, the process dies and usually restarts. That way, the system doesn’t become 
                           如果一个umdf驱动崩溃，这个进程死掉并且重启。那样，这个系统不会变成不稳定。
unstable; the device simply becomes unavailable while the service hosting the driver restarts.
这个设备简单变成不可行同时这个服务让设备重启。