1.2.3 Kernel Driver Initialization: Phase 5

The Registry’s System hive, which is visible to users under the HKEY_LOCAL_MACHINE tree after the system is running, determines the load order of all drivers in the system. The NTLDR or OSLOADER and the I/O Manager both access the contents of the System hive to determine which drivers should be loaded and when each driver should be initialized.

Each driver key under the registry node HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services has a value entry named Start. The value assigned to Start determines when any particular driver is loaded during the system initialization process, as follows:

• Start = 0 indicates the driver is loaded by NTLDR or OSLOADER during Phase 2.

• Start = 1 indicates the driver is loaded by the I/O Manager during Phase 5.

• Start = 2 indicates the driver is started by Service Controller manager.

• Start = 3 indicates the driver must be manually started by using the services icon of the Control Panel.

• Start = 4 indicates the driver was disabled and made unloadable.

When each driver is loaded, its DriverEntry routine is automatically called by the I/O Manager.

For each device object created, a driver may create a corresponding value entry with a name that is the same as the device object in the registry under HKEY_LOCAL_MACHINE\Hardware\DeviceMap.

Both the created value entry in the registry DeviceMap and the symbolic link are volatile: each is regenerated automatically every time the machine is booted, based on the drivers that were initialized by the I/O Manager. Both are logical names representing a device in the machine.