A quick search in the Web reveals that the number of the books that are related to Windows Device drivers can be counted with the fingers of one hand. even worse, most of the books are either too old (published before or around Windows 2000) and/or not easily
Readable. Another problem is that the Windows Driver Model (WDM) is becoming more complex as time passes, so the newer books are relatively more complex to read than the older ones.
Based on all of this and after looking at different book reviews, I decided to read a few books that make it easier for a beginner to get an insight on driver development.
So, I think that the best book to start with regarding driver development is
Windows NT device driver development (OSR classic reprints) (original version was published in 1997) by Peter G. viscarola and W. anthony Mason. this book is divided into 3 parts. the first part (Chapters 1-8) Talk about Windows internals fundamental concepts,
Like Hal, scheduling, virtual memory, registry, etc. the second part (chapters 9-20) is the bulk of the book and talks about the development of device drivers. actually, this can be further subdivided into chapters 8-10, which talk about the I/O manager, 11-17,
Which is the core part of the book (DriverEntry, dispatch routines, interrupt service routines, deffered procedure CILS, programmed I/O and DMA), and chapters 18-20, which talk about building and debugging a driver. finally, Chapters 21-24 talk about alternate
NT driver ubuntures, like file system drivers, scsi drivers, video miniport drivers and NDIS (network) miniport drivers. I think that there are both advantages and disadvantages in this book. i'll start with the advantages:
- It's very easy to read. it starts with very fundamental stuff, builds on top of them and explains the concepts in an easy-to-understand way. this is really to hard to find in the rest of the books. possibly the fact that both writers teach driver development
Courses make it easier for them to understand what questions and problems a beginner driver developer might have, so they try to answer them in front.
- It focuses on explaining the concepts and doesn' t present pages and pages of un-understandable code. it just presents the funher, explains how they work and shows a cumulative example that shows the use of a few functions bundled together.
- It's a short book (the first 20 chapters take less than 550 pages) and has small chapters. I think that this fine grain analysis helps the reader. I like the fact that I can read a few small chapters within a day and then pickup the book the next day (or
A few days later) without breaking my reading in the middle of the chapter and trying to remember what the first part of the chapter was saying.
Of course, the book has also some disadvantages:
- It doesn't cover plug-n-play, power management and other WDM concepts. this is normal, since the book covers nt drivers and not WDM drivers. I haven't found into outdated parts of the book (I. e. almost everything that is written in the book applies even
For WDM drivers in Windows XP), apart from the fact that the DriverEntry chapter (chapter 13) talks a ablot out manually finding the resources (memory + I/O) that the driver shoshould be using, whereas for WDM drivers this is done automatically. it also doesn' t
Cover physical device objects (PDOs), Function Device objects (fdos) and filter device objects (fidos), since they didn't exist at that time.
- The examples are small and after understanding the concepts, it's nice to be able to look at some code that will explain them.
So, in order to solve the disadvantages of the first book, I think that the solution is to read
The Windows 2000 Device Driver book: A Guide for programmers (2nd edition) (published in 2000) by art Baker and Jerry Lozano. the strengths of this book are exactly those above:
- The book covers Windows 2000 drivers, so it covers power management, plug-n-play, Windows Management Instrumentation (Wmi) and writable WDM concepts that were not covered by the first book.
- The book is full of examples. The writer also provides the source code in the accompanying CD-Rom, so it's easy to build them and learn from the source.
- Again, the book is easy to read and short. I like a lot compact books that stick to the topic and don't provide stuff that distract the reader. this book is one of those. the whole book is around 400 pages, so it can be finished quite quickly.
So, after finishing both these books and playing with the source code (and with the source code that can be found in the wdk or elsewhere in the net ), I think that the next step is to read
Programming the Microsoft Windows Driver Model, second edition (published in 2002) by Walter oney. Again, this book has both advantages and disadvantages. This time, I'll start with the distagadvanes
:
- This book is definately not for beginners. I consider it hard to understand and it considers way too things as known.
- I don't like the structure of the book very well. for example, even though the author mentions that the first 7 chapters are fundamentals and the rest go deeper, he puts the I/O control operations after the plug-n-play or the power management. of course,
This is a personal view, however I was overwhelmed, When I managed to reach the 6th Chapter. the first 3 chapters are very good, however I think that after that the difficulty grows exponentially, at least for a beginner.
- The material presented in the book is very dense, so a lot of stuff is presented within a small number of pages and then you look at a big code listing that shocould explain everything. as I said above, I prefer a slower approach that goes step by step and
Builds on top of fundamental concepts.
- I don't think that the book gives a clear high-level view of what a device driver is composed of (I'll explain this below ). I had the feeling that the author explains one thing, then the next and the next, but it's hard to understand how everything fits
Together and how all of these components are related.
On the other hand, this book has some advantages that cannot be covered by any other existing book:
- It is the newest book, so it provides the best picture about the current version of the Windows Driver Model (WDM ).
- It's the only book that covers Windows XP, so it's the only choice for somebody, who wants to take advantage of this platform.
- I think that each section is described more deeply than from the rest of the books.
Finally, I think that such a review wocould be incomplete, if I didn't refer
Microsoft Windows internals, Fourth Edition: Microsoft Windows Server (TM) 2003, Windows XP, and Windows 2000 (Pro-Developer) (published in December 2004) by Mark E. russinovich and David. solomon. this book doesn' t talk directly about Writing Device
Drivers, But it talks about Windows Internals in general. some of them are covered in the above mentioned books, however this book is the newest of all and provides the most in-depth analysis. also, Chapter 9 is already Ted specifically to the I/O manager and
To Windows Device Drivers, so it's definately worth to read. I especially like one particle section in chapter 9 that is titled"Structure of a driver"And gives a high-level overview of all the components of a driver. That's exactly
Important thing that is missing from Walter oney's book and is not clearly explained in the rest of the books. So, according to the book, a Windows Device Driver is composed:
- An initialization routine:This function is named DriverEntry (for WDM drivers) and is called by the I/O manager only once, when the driver is initially loaded. it is used by the driver to initialize its internal (global) structures.
- An add-on device routine:This function is named adddevice and is called by the I/O manager, whenever a new device, for which the driver is responsible, is detected. it is used by the driver to initialize the device object (I. e. the internal
Structure) that corresponds to the newly-found device.
- A set of dispatch routines:These are the functions that are called by an application (or another driver) to communicate with the device. they include functions like read, write, open, close, control, etc. when called to perform an I/O
Operation, the I/O manager creates an IRP (I/O Request Packet), which is a structure that descibes the request, and sends it to the driver.
- An interrupt service routine (ISR ):One of the ways that an external device can communicate with the CPU is through interrupts (the other way is polling, but let's forget about it for now ). so, whenever the device wants to communicate
The CPU, it sends an interrupt to the CPU and the CPU executes some code that needs to serve the device (e.g. find if the device finished some calculation or specified ed a packet, etc and find what to do afterwards ). the code that is executed is called the interrupt
Service Routine (ISR). Therefore, the driver that controls the device needs to implement this ISR.
- Deffered Procedure Call (DPC ):Whenever an ISR is executing, the IRQL (IRQ level) of the CPU is high, so all the interrupts that have lower IRQL than the current interrupt cannot be served. in order to solve this problem, drivers perform
Only very basic calculation in their ISR and for the rest of the processing they schedule a DPC. this function executes in a low IRQL (which is named dispatch_level), so that the rest of the interrupts can be serviced. therefore, the DPC can be considered
As just an extension to the ISR (they serve the same purpose, but they execute at different IRQL ). of course, a driver can execute dpcs not only from an ISR, but from any other function, however this is the main use of a DPC.
- A start I/O routine:Some drivers wants to process the incoming I/O Requests serially, I. e. one at a time. therefore, they ask the I/O manager to queue the incoming IRPs. this function is used to initiate the next data transfer to or from
The device.
- One or more I/O completion routines:Sometimes a driver, which has es an I/O Request does some processing and passes the IRP to the next driver in the stack, without finalizing the IRP processing (finalizing means that the I/O operation
Was completed successfully, failed or canceled ). the I/O completion routine informs the driver that another driver in the stack has marked the I/O as "finalized ", so the current driver's I/O completion routine can be called, in order to perform some cleanup
Operations.
- A cancel I/O routine:This function is called, when the I/O manager wants to cancel the processing of an IRP. this function mostly releases any resources that were acquired during the processing of the IRP and it also marks the IRP as "canceled ".
Not all IRPs can be canceled, though.
- An unload routine:The I/O manager CILS this routine, when it wants to unload the driver from memory. The drives releases any resources that it might have acquired.
- A system shutdown notification routine:The I/O manager CILS this routine, when the system is about to shutdown.
- Error-logging routines:Whenever an error occurs, the driver uses these routines to log the error and handle y the I/O manager.
Here I wowould like to note that all the above books are for the Windows Driver Model. as I 've mentioned when times before, Microsoft is changing the driver model for Windows Vista. however, there aren't any books for the Windows Driver Foundation (WDF-
New windows model) yet. The only public announcement for such a book is
Introduction to the Windows Driver Foundation-kernel mode driver framework by Peter viscarola, Tony Mason, Mark Cariddi, Brenda Ryan, Scott noone, and OSR.
