This presentation covers overview of Windows Driver Framework (WDM) which explains Windows Architecture, Windows Driver Overview, WDM Layered Architecture and basic data structures. This has detail explanation of all basic modules and layers of WDM. Helpful for beginners.

1. Windows Driver Model Overview
Prasad Talekar
Windows Driver Model Overview 1

2. Agenda
Windows Driver Model Overview 2
Windows Architecture1
Device Driver Overview2
What is WDM3
WDM Layered Architecture4
WDM Device Objects5

3. Windows Architecture
Windows Driver Model Overview 3

4. Device Driver
• Only one that can touch hardware, handle interrupts, etc.
• Has a SYS extension
• Its routines always run in kernel mode
• Also called “Privileged mode”
• Ring 0 on 80x86
• Always uses the kernel mode stack
• Unhandled exceptions will crash the system
• Producing the infamous “Blue Screen of Death”
• Usually invoked by a user mode code (ReadFile, WriteFile,
DeviceIoControl)
Windows Driver Model Overview 4

5. Windows Driver Model (WDM)
• A model for writing device drivers
• Source compatibility between Windows 98/ME and Windows 2000/XP
• Be designed as a bus driver, a function driver, or a filter driver, as described
in Types of WDM Drivers.
• Create device objects as described in WDM Device Objects and Device
Stacks.
• Standard handling for Plug & Play (P&P), Power Management and Windows
Management Instrumentation (WMI)
• Supports a wide range of buses (PCI, USB, IEEE1394 and more)
• Extensible to support future buses
• Supports a wide range of device classes (HID, Scanners, Modems, etc.)
Windows Driver Model Overview 5

6. Benefits of Windows Driver Model
• WDM helps developers produce more robust drivers with less effort.
• Driver developers can gain substantial benefits from studying the WDM
model for their device class during early driver development and test
planning:
• Developers can write one driver for multiple platforms.
• Developers can use one development environment, the latest Windows
DDK, which will be released concurrently with the release of
Windows XP.
• Writing one driver for multiple platforms means that developers can
create and manage a single source-code base rather than writing a
separate driver for each platform, and this reduces the amount of code
that must be tested and debugged.
Windows Driver Model Overview 6

7. Benefits of Windows Driver Model
• The WDM strategy is a cornerstone of Microsofts driver quality
initiative, which includes:
• The Windows DDK, which provides build environments, sample code, and
documentation for developing WDM drivers.
• Test tools, such as Driver Verifier and the Windows Hardware Compatibility
Tests, supplied with the Windows DDK.
• All bus drivers are supplied by Microsoft.
• For as many device classes as possible, contribute WDM code that enables a
port/miniport driver model.
• Microsoft Technical Support for driver developers.
• Driver signing, which contributes to the stability of the Windows operating
system in the field by guarding against the installation of untested device
drivers.
• Testing of final versions of third-party device drivers by Windows Hardware
Quality Labs (WHQL).
Windows Driver Model Overview 7

8. WDM Driver Stack
Windows Driver Model Overview 8
• There are three kinds of WDM drivers:
– Bus drivers, which drive an I/O bus and provide
per-slot functionality that is device-independent.
– Function drivers, which drive an individual device.
– Filter drivers, which filter I/O requests for a
device, a class of devices, or a bus.
• In this context, a bus is any device to which
other physical, logical, or virtual devices are
attached; a bus includes traditional buses such
as SCSI and PCI, as well as parallel ports, serial
ports, and i8042 ports.

9. WDM Driver Stack
Windows Driver Model Overview 9
• A bus driver services a bus controller, adapter, or
bridge.
• Bus drivers are required drivers; there is one bus
driver for each type of bus on a machine.
• Microsoft provides bus drivers for most common
buses. IHVs and OEMs can provide other bus drivers.
• A bus filter driver typically adds value to a bus and
is supplied by Microsoft or a system OEM. There can
be any number of bus filter drivers for a bus.
• Lower-level filter drivers typically modify the
behavior of device hardware.
• They are optional and are typically supplied by
IHVs. There can be any number of lower-level filter
drivers for a device.

10. WDM Driver Stack
Windows Driver Model Overview 10
• A Function driver is the main driver for a device.
• Function Driver is something which is a called as
Driver.
• A function driver is typically written by the device
vendor and is required (unless the device is being
used in raw mode).
• Upper-level filter drivers typically provide added-
value features for a device. They are optional and
are typically provided by IHVs.

11. Bus Driver
• The primary responsibilities of a bus driver are to:
– Enumerate the devices on its bus.
– Respond to Plug and Play IRPs and power management IRPs.
– Multiplex access to the bus (for some buses).
– Generically administer the devices on its bus. During enumeration, a
bus driver identifies the devices on its bus and creates device objects
for them. The method a bus driver uses to identify connected devices
depends on the particular bus.
• A bus driver performs certain operations on behalf of the devices on its
bus, including accessing device registers to physically change the power
state of a device. For example, when the device goes to sleep, the bus
driver sets device registers to put the device in the proper device power
state.
Windows Driver Model Overview 11

12. Bus Driver
• A bus driver does not handle read and write requests for the devices on
its bus. Read and write requests to a device are handled by the device's
function driver. Only if the device is being used in raw mode does the
parent bus driver handle reads and writes for the device.
• A bus driver acts as the function driver for its controller, adapter, or
bridge, and therefore manages device power policy for these
components.
• A bus driver can be implemented as a driver/minidriver pair.
Windows Driver Model Overview 12

13. Function Driver
• A function driver is the main driver for a device and is typically written by the
device vendor and is required (unless the device is being used in raw mode).
• The PnP Manager loads at most one function driver for a device.
• A function driver provides the operational interface for its device. Typically
the function driver handles reads and writes to the device and manages
device power policy.
• The function driver for a device can be implemented as a driver/minidriver
pair, such as a port/miniport driver pair or a class/miniclass driver pair.
• If a device is being driven in raw mode, it has no function driver and no upper
or lower-level filter drivers. All raw-mode I/O is done by the bus driver and
optional bus filter drivers.
Windows Driver Model Overview
13

14. Filter Driver
Filter drivers are optional drivers that add value to or modify the
behavior of a device. A filter driver can service one or more devices.
There are three types of Filter Drivers
– Bus Filter Driver
– Lower Level Filter Driver
– Upper Level Filter Driver
Bus Filter Drivers - Typically add value to a bus and are supplied by
Microsoft or a system OEM. Bus filter drivers are optional. There can be
any number of bus filter drivers for a bus.
A bus filter driver could, for example, implement proprietary
enhancements to standard bus hardware.
Windows Driver Model Overview 14

15. Filter Driver (Conti)
Lower-Level Filter Drivers - Typically modify the behavior of device hardware. They are
typically supplied by IHVs and are optional and can be any number of lower-level filter
drivers for a device.
A lower-level device filter driver monitors and/or modifies I/O requests to a particular
device. Typically, such filters redefine hardware behavior to match expected specifications.
A lower-level class filter driver monitors and/or modifies I/O requests for a class of devices.
For example, a lower-level class filter driver for mouse devices could provide acceleration,
performing a nonlinear conversion of mouse movement data.
Upper-Level Filter Drivers. Upper-level filter drivers typically provide added-value features
for a device. Such drivers are usually provided by IHVs and are optional.
An upper-level device filter driver adds value for a particular device. For example, an upper-
level device filter driver for a keyboard could enforce additional security checks.
Windows Driver Model Overview
15

16. WDM Driver Stack
Windows Driver Model Overview 16
•Above the driver stack is an application. The
application handles requests from users and other
applications, and calls either the Win32 API or a
routine that is exposed by the user-mode client driver.
•A user-mode client driver handles requests from
applications or from the Win32 API. For requests that
require kernel-mode services, the user-mode client
driver calls the Win32 API, which calls the appropriate
kernel-mode client or support routine to carry out the
request. User-mode client drivers are usually
implemented as dynamic-link libraries (DLL).
•A kernel-mode client driver handles requests similar
to those handled by the user-mode client, except that
these requests are carried out in kernel mode, rather
than in user mode.

17. WDM Driver Stack
Windows Driver Model Overview 17
•A device class and miniclass driver pair provides
the bulk of the device-specific support.
• The class driver supplies system-required but
hardware-independent support for a particular class
of device. Class drivers are typically supplied by
Microsoft.
• A miniclass driver handles operations for a
specific type of device of a particular class. For
example, the battery class driver supports common
operations for any battery, while a miniclass driver
for a vendor's UPS device handles details unique to
that particular device. Miniclass drivers are typically
supplied by hardware vendors.

18. WDM Driver Stack
Windows Driver Model Overview 18
•A corresponding port driver (for some devices, this is a
host controller or host adapter driver) supports required
I/O operations on an underlying port, hub, or other
physical device through which the device attaches.
•Whether any such drivers are present depends on the
type of device and the bus to which it eventually
connects. All driver stacks for storage devices have a
port driver.
•A corresponding miniport driver handles device-specific
operations for the port driver. For most types of devices,
the port driver is supplied with the operating system,
and the miniport driver is supplied by the device vendor.
•At the bottom of the figure is the hardware bus driver.
Microsoft supplies bus drivers for all the major buses as
part of the operating system. You should not attempt to
replace these drivers.

19. Device Objects
Windows Driver Model Overview 19
•Represents a stack of devices
• PDO: Physical Device Object
• Created by the bus driver
•FiDO: Filter Device Object
• Optional lower/upper device objects
•FDO: Functional Device Object
• The “actual” WDM driver created device
object

20. Device Enumeration
• Upon boot, the P&P Manager performs enumeration of buses
and devices
• Starts from an imaginary “Root” device
• Scans the system recursively to walk the device tree
• Creates a PDO for each physical device
• Loads lower filter drivers (if exist)
• They create their FiDOs
• Loads “the driver”
• It should create the FDO
• Loads upper filter drivers (if exist)
• They create their FiDOs
Windows Driver Model Overview 20

21. Two Basic Data Structures
Windows Driver Model Overview 21
• DRIVER_OBJECT
 Represents the driver for the I/O system
 Includes dispatch routine pointers, AddDevice
routine pointer, Unload routine pointer, etc.
 Created by the Kernel, passed to driver and filled
by it

22. Two Basic Data Structures
Windows Driver Model Overview 22
• DEVICE_OBJECT
 Defines a specific device (usually hardware)
 Associated with File objects
 Allows for driver-defined extensions
 Provides a DPC object for after Interrupt
processing
 Created by the driver using IoCreateDevice
 Several may be created

23. Windows Driver Model Overview 23
Q & A