The Windows ACPI driver, Acpi.sys, is an inbox component of the Windows operating system. The responsibilities of Acpi.sys include support for power management and Plug and Play (PnP) device enumeration. On hardware platforms that have an ACPI BIOS, the HAL causes Acpi.sys to be loaded during system startup at the base of the device tree. Acpi.sys acts as the interface between the operating system and the ACPI BIOS. Acpi.sys is transparent to the other drivers in the device tree.
For each device described in the ACPI namespace hierarchy, the Windows ACPI driver, Acpi.sys, creates either a filter device object (filter DO) or a physical device object (PDO). If the device is integrated into the system board, Acpi.sys creates a filter device object, representing an ACPI bus filter, and attaches it to the device stack immediately above the bus driver (PDO). For other devices described in the ACPI namespace but not on the system board, Acpi.sys creates the PDO. Acpi.sys provides power management and PnP features to the device stack with these device objects. For more information, see Device stacks for an ACPI device.
Acpi.sys and the ACPI BIOS support the basic functions of an ACPI device. To enhance the functionality of an ACPI device, the device vendor can supply a WDM function driver. For more information, see Operation of an ACPI device function driver.
An ACPI device is specified by a definition block in the system description tables in the ACPI BIOS. A device's definition block specifies, among other things, an operation region, which is a contiguous block of device memory that is used to access device data. Only Acpi.sys modifies the data in an operation region. The device's function driver can read the data in an operation region but must not modify the data. When called, an operation region handler transfers bytes in the operation region to and from the data buffer in Acpi.sys. The combined operation of the function driver and Acpi.sys is device-specific and is defined in the ACPI BIOS by the hardware vendor. In general, the function driver and Acpi.sys access particular areas in an operation region to perform device-specific operations and retrieve information. For more information, see Supporting an operation region.
ACPI control methods are software objects that declare and define simple operations to query and configure ACPI devices. Control methods are stored in the ACPI BIOS and are encoded in a byte-code format called ACPI machine language (AML). The control methods for a device are loaded from the system firmware into the device's ACPI namespace in memory, and interpreted by the Windows ACPI driver, Acpi.sys.
To invoke a control method, the kernel-mode driver for an ACPI device initiates an IRP_MJ_DEVICE_CONTROL request, which is handled by Acpi.sys. For drivers loaded on ACPI-enumerated devices, Acpi.sys always implements the physical device object (PDO) in the driver stack. For more information, see Evaluating ACPI control methods.
Revision 5.0 of the ACPI specification introduces a set of features to support low-power, mobile PCs that are based on System on Chip (SoC) integrated circuits and that implement the connected standby power model. Starting with Windows 8 and later versions, the Windows ACPI driver, Acpi.sys, supports the new features in the ACPI 5.0 specification. For more information, see Windows ACPI design guide for SoC platforms.
The following command uses the DevCon DriverFiles operation to list the file names of drivers that devices on the system use. The command uses the wildcard character (*) to indicate all devices on the system. Because the output is extensive, the command uses the redirection character (>) to redirect the output to a reference file, driverfiles.txt.
The following command uses the DevCon DriverFiles operation to search for the device driver that the mouse device on the local computer uses. It identifies the device by one of its hardware IDs, HID\Vid_045e&Pid_0039&Rev_0121. The hardware ID is enclosed in quotation marks because it includes the ampersand character (&).
The following command uses the DevCon DriverNodes command and an ID pattern to list the driver nodes of software-enumerated devices. Patterns are useful for finding information about similar devices that might not be in the same setup class.
The following command uses the DevCon DriverNodes operation to list the driver packages of all devices whose device instance IDs begin with ROOT\MEDIA, that is, devices in the Enum\Root\Media registry subkey. The command uses the at character (@) to indicate that the phrase is in the device instance ID.
The following command uses the DevCon Stack operation to search for devices in the Volume setup class and display the expected driver stack for those devices. The equal sign (=) indicates that the string is a class name.
In response, DevCon displays the expected stack for the devices in the Volume class. The returned data includes the device instance ID and description of each device, the GUID and name of the device setup class, the names of upper and lower filter drivers, and controlling services (if any).
The DevCon Stack operation returns the setup class of a device in addition to the upper and lower filter drivers. The following commands find the setup class of the printer port interface by finding its device instance ID and then using the device instance ID to find its setup class.
The following command uses the DevCon Stack operation to display the expected stack for miniport driver devices. It searches for devices in the Net setup class that have "miniport" in their hardware ID or compatible ID.
The following command uses the DevCon Find operation to search for mouse devices. Specifically, the command searches the computer for devices whose hardware ID or compatible ID includes "mou.", and would not find a "moose" driver.
Because all DevCon display operations also find hardware IDs, you can use any display operation to search for hardware IDs. Select the operation based on the content that you need in the output. For example, to find the device drivers that mouse-related devices on a local computer use, submit the following command.
The first command finds legacy drivers by a device instance ID pattern. The ID pattern is prefaced by the at character (@) to indicate a device instance ID and followed by the wildcard character (*) to find all devices in the ROOT\Legacy subkey.
In response, DevCon lists the following seven devices in the Net setup class. The first six are standard miniport driver devices. The seventh device, the RAS async adapter, is a software-enumerated device (SW\*) that is not installed until it is needed.
The following command uses the DevCon ClassFilter operation to display the upper filter drivers for the DiskDrive setup class. Because this command includes no classfilter operators, DevCon displays the filter drivers for the class, but does not change them.
In response, DevCon displays the upper filter drivers for the DiskDrive class and confirms that it did not change them. In this case, the display shows that devices in the DiskDrive setup class use the PartMgr.sys upper filter driver.
When the command starts, the virtual cursor is positioned before the first filter driver. Because it is not positioned on a particular driver, DevCon adds the Disklog driver to the end of the filter driver list.
If you misspell the driver name, or try to add a driver that isn't installed on the system, the command fails. DevCon does not add a driver unless the driver is registered as a service, that is, unless the driver has a subkey in the Services registry subkey (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services).
The following command uses the DevCon ClassFilter operation to add a fictitious filter driver, MyFilter.sys, to the list of upper filter drivers for the DiskDrive setup class. The command places MyFilter.sys between PartMgr.sys and Disklog.sys in the load order.
The first subcommand, @Disklog, uses the positioning operator (@) to place the virtual cursor on the Disklog filter driver. The second subcommand, -MyFilter, uses the add-before operator (-) to add MyFilter.sys before Disklog.sys.
The positioning operator is essential in this example. Before DevCon processes any classfilter subcommands, the virtual cursor is at the beginning of the list and is not positioned on any filter drivers. If you use the add-before (+) operator when the cursor is not on positioned on a driver, DevCon adds the driver to the beginning of the list. If you use the add-after (-) operator when the cursor is not positioned on a driver, it adds the driver to the end of the list.
You can also use the following command to add the MyFilter driver and to place it between PartMgr and Disklog. In this example, the first subcommand, @PartMgr, positions the virtual cursor on the PartMgr filter driver. The second subcommand, +MyFilter, uses the add-after operator (+) to add MyFilter.sys after PartMgr.
The following command uses the DevCon ClassFilter operation to replace the original copy of MyFilter.sys with a new and improved version, MyNewFilter.sys, in the list of filter drivers for the DiskDrive setup class.
The first subcommand uses the delete operator (!) to delete MyFilter from the list of upper filter drivers for the DiskDrive class. (It does not affect the MyFilter.sys file in the C:\Windows\System32\Drivers directory.)
The second subcommand uses the add-after operator (+) to place the new filter driver in the position that the deleted driver occupied. Because the delete operator leaves the cursor in the position that the deleted filter occupied, the add-before (-) and add-after (+) operators have the same effect.) 2b1af7f3a8