Windows Hardware and the Registry

Introduction

Windows 95 has sophisticated device configuration, which can be viewed in the Device Manager tab in System Properties and the Network Control Panel. It is implemented in the registry, but very little has been written about it. Here's what I've learned by hacking the registry and digging in INF files.

If I get ambitous, I will include some screen shots from regedit, but for now fire up Device Manager and regedit alongside your web browser.

Registry Structures

There are three data structures in the registry that contain device configuration information. The software tree contains software nodes organized by class names (fdc/hdc/DiskDrive). The Device (enum) tree contains Device nodes organized by bus enumerator (PCI/SCSI). The hardware tree is a tree with references to active Device nodes.

Plug and Play is designed around the static device (enum) tree and a dynamic hardware tree. The hardware nodes point to device nodes which are currently active. Device Manager viewed by type displays these nodes organized by the device class. Device Manager viewed by connection displays a tree (starting with ROOT enumerator), showing the relationship between bus controllers and their devices.

The Device tree

The Configuration Manager is the ring 0 component of Windows 95 that controls hardware resources and changes in hardware configuration. Its database is the device tree, stored under HKLM\Enum\. The nodes of the device tree represent devices or bus controllers. There is also a dynamic hardware tree under HKDD\Config Manager\Enum\, which points to device nodes that are active in the current configuration.

Device configuration is organized by bus structure. For example, a serial port is on the ISA bus, and a modem is on the serial bus. You can see this structure to some extent in Device Manager when you view by connection. You have to dig into the registry to really understand it.

Various bus enumerators construct the device tree. Plug and Play enumerators run every time you start Windows, and when you click Refresh in Device Manager. Legacy enumerators for ISA/VLB run only in Windows Setup and Add New Hardware, because they are slow and may hang the machine when probing for devices. Devices stay in the device tree even after they are removed physically.

Device nodes have a three level name. The first subkey is the enumerator, the second subkey is the device-id, and the third subkey is the instance. The format of the last two subkeys depend on the enumerator. The instance is usually a sequence number, the position on a bus (PCI), or the combined enumerator&device-id&instance of the parent device. Example names are BIOS\*PNP0A03\00, FLOP\GENERIC_NEC__FLOPPY_DISK_\ROOT&*PNP0700&000000, PCI\VEN_1098&DEV_0002\BUS_00&DEV_19&FUNC_00.

PCI is the PCI enumerator. The device-id is the PCI vendor&device, and the instance is the PCI bus&device&function. The enumerator does hardware enumeration, but in the latest Windows 95 OEM SR2 you can select BIOS enumeration and configuration.

For many enumerators, EISA device-ids are used. They combine a a 3-letter manufacturer code, a 3-digit (hexadecimal) product identifier, and a 1-digit revision number (all encoded into 31 bits). These Plug and Play device-ids are available at http://ms/devids.txt. The manufacturer code PNP is used by Microsoft to for generic and pseudo devices that don't have EIAS ids. A leading * is prefixed to EISA ids except in the ISAPNP enumerator.

BIOS is for system (embedded on main board) devices reported by a Plug and Play BIOS.

ISAPNP is the ISA Plug and Play enumerator. The device-id is the EISA id combined with a device number, and the instance is the card's serial number. ISAPNP\READDATAPORT\0 is one of the ISA PnP config registers. The enumerator does hardware configuration if a PnP BIOS is not available.

ROOT is the root enumerator for legacy ISA/VLB devices. You will see Microsoft's *PNP#### device-ids when automatic hardware detection was used. The *PNP0500 id (serial ports) occurs in either the BIOS/ISAPNP or ROOT enumerators, depending whether the device was detected by the PnP BIOS or by legacy device probing. Manually installed devices, including network adaptors, have the class name as device-id (Net for Dial-up Adaptor).

PCMCIA is the PC Card 16 enumerator, with tuples for device-ids.

ESDI is for ATA and ESDI disk drives, with Disk Type as the device-id, and a combined subkey referring to the parent HDC. I believe ATA (IDE) disks are enumerated from the BIOS Drive Parameter Table, but the Triones driver uses the identify drive command. ATAPI (CD/Tape) devices appear under SCSI. [???]

FLOP is similar to ESDI.

LPTENUM and SERENUM are the parallel and serial bus enumerators, with a combined instance referring to the parent controller.

MF is for multifunction PCI devices. The parent device is elsewhere in the tree (used to control resources), and the child devices appear here as independent devices.

NETWORK are the network layers (except for adaptors), with the protocol name as device-id.

SCSI is similar to ESDI, but the BIOS is not used for enumeration.

HTREE\Reserved\0 holds the resources you have reserved under Device Manager's Computer Properties.

Device nodes have several standard key-value pairs. Mfg and DeviceDesc are names for human consumption. Driver contains the class\number subkey in the software tree, which is how the device tree links to the software tree.

The Hardware tree

The hardware tree is constructed every time Windows starts or you click Refresh in Device Manager and is maintained as device configuration changes. In regedit it appears to be a list, but is really the tree you see in Device Manager View by connection, with root HTREE\ROOT\0 and parent, child, and sibling links in each node. It lies under HKDD\Config Manager\Enum. The subkeys are VM addresses, and the HardWareKey value refers to a subkey of HKLM\Enum in the device tree.

The Current Control Set

The Current Control Set contains information to load and start Windows Ring 0 components. There are two keys under HKLM\System\CurrentControlSet. From the Windows 95 Resource Kit: The Control key contains information used to control system startup, including the computer’s network name and the subsystems to start. The Services key contains information to control the loading and configuration of drivers, file systems, and so on. The data in the Services key also controls how these services call each other. The Class and VxD branches described below.

The Software tree

Almost every device node has a corresponding node in the software tree. Devices are organized in classes, like Ports for serial/parallel ports, and Net for network adaptors. The UI for non-network classes in ControlPanel | System | Device Manager, and for network classes is ControlPanel | Network. The registry key for classes is HKLM\System\CurrentControlSet\Services\Class. The first subkey is the class name, and the second subkey is an index. They contain information for the Device/Network Property sheets to display, any VxD drivers to load, Device Manager property sheet DLLs, configuration information that does not belong in the device tree.

The VxD tree

This contains an entry for every statically loaded VxD in the system.

There are some global setting for drivers under HKLM\System\CurrentControlSet\Services\VxD. For example, the MSTCP Default Receive Window.

References

The System Configuration section of the Windows 95 Resource Kit is very useful. The Plug and Play BIOS specification is available at http://www.microsoft.com/hwdev/ . Systems Programming for Windows 95 by Walter Oney (Microsoft Press) is a good book on Windows 95 internals and device drivers.