Kernel-Mode Driver Architecture Design Guide
For information about programming interfaces that your driver can implement or call, see the Kernel-Mode Driver Reference.
This section includes general concepts to help you understand kernel-mode programming and describes specific techniques of kernel programming. For a general overview of Windows Drivers, see Getting Started with Windows Drivers, which provides a general overview of Windows components, lists the types of device drivers used in Windows, discusses the goals of Windows device drivers, and discusses generic sample device drivers included in the kit.
This section contains conceptual information that describes and helps you build kernel-mode drivers.
An Overview containing:
Kernel-Mode Components describes the primary kernel-mode managers and components of the Windows operating system.
Component Description Managers Windows Kernel-Mode Object Manager Manages objects: files, devices, synchronization mechanisms, registry keys, and so on. Windows Kernel-Mode Memory Manager Manages physical memory for the operating system. Windows Kernel-Mode Process and Thread Manager Handles the execution of all threads in a process. Windows Kernel-Mode I/O Manager Manages the communication between applications and the interfaces provided by device drivers. Windows Kernel-Mode Plug and Play Manager A subsystem of the I/O manager, the Plug and Play (PnP) Manager enables a PC to recognize when a device is added to the system. Windows Kernel-Mode Power Manager Manages the orderly change in power status for all devices that support power state changes. Windows Kernel-Mode Configuration Manager Manages the registry, such as monitoring changes in the registry or registering callbacks on specific registry data. Windows Kernel-Mode Kernel Transaction Manager Implements transaction processing in kernel mode. Windows Kernel-Mode Security Reference Monitor Provides routines for your driver to work with access control. Libraries Windows Kernel-Mode Kernel Library Implements the core functionality that everything else in the operating system depends upon. The Microsoft Windows kernel provides basic low-level operations such as scheduling threads or routing hardware interrupts. Windows Kernel-Mode Executive Support Library Refers to kernel-mode components that provide a variety of services to device drivers, including: object management, memory management, process and thread management, input/output management, and configuration management. Windows Kernel-Mode Run-Time Library A set of common utility routines needed by various kernel-mode components. Windows Kernel-Mode Safe String Library A safe string library to provide greater security in kernel-mode development. Windows Kernel-Mode DMA Library A direct memory access (DMA) library for device driver developers. Windows Kernel-Mode HAL Library A hardware abstraction layer (HAL) for kernel-mode driver development. Windows Kernel-Mode CLFS Library A transactional logging system, the Common Log File System (CLFS). Windows Kernel-Mode WMI Library A general mechanism for managing components, called Windows Management Instrumentation (WMI).
Device Objects and the other topics in Device Objects and Device Stacks describe how the operating system represents devices by device objects.
Memory Management for Windows Drivers illustrates how kernel-mode drivers allocate memory for purposes such as storing internal data, buffering data during I/O operations, and sharing memory with other kernel-mode and user-mode components.
Handling IRPs describes how kernel-mode drivers handle I/O request packets (IRPs).
DMA Direct Memory Access (DMA) is a critical aspect of driver development, and the topics in this node cover DMA from A to Z.
Controller Objects represent a physical device controller with attached devices.
Interrupt Service Routines (ISRs) handle interrupts for drivers of a physical device that receives interrupts.
Message-Signaled Interrupts trigger an interrupt by writing a value to a particular memory address.
Deferred Procedure Calls (DPC Objects) can be queued from ISRs and are executed at a later time and at a lower IRQL than the ISR.
Plug and Play (PnP) focuses on the system software support for PnP and how drivers use that support to implement PnP.
Power Management describes the architecture that provides a comprehensive approach to system and device power management.
Windows Management Instrumentation (WMI) are extensions to your kernel-mode driver, which enable your driver to become a WMI provider. A WMI provider makes measurement and instrumentation data available to WMI consumers, such as user-mode applications.
Driver Programming Techniques Programming drivers in the kernel mode of Windows requires techniques that sometimes differ significantly from those of ordinary user-mode programming.