Writing WDM Kernel Mode Drivers for Windows
The seminar covers both the architectural background and the practical details of implementing real, useful, WDM drivers. Of course, like all our seminars, this seminar is taught by experienced Windows driver writers who've "been there."
The overall goal of this seminar is to provide students with the necessary knowledge to design, develop, and test many types of Windows WDM drivers. The key to reaching this goal is gaining a solid knowledge of the underlying architecture and operating principals of the Windows I/O, PnP, and Power subsystems. After taking this seminar, students will have the specific knowledge to write simple WDM Programmed I/O drivers, or to go on to learn the implementation details of how to write drivers using one of the various WDM-based Miniport architecture (such as StorPort, AVStream, or other types of devices).
Length: 5 days
Format: Lecture and Lab
Cost: $3,425 ($3,950 for non-U.S. locations)
4 week advanced payment -10%; 2 week advanced payment -5%
(contact OSR for previous and multi-student discounts)
Current SchedulePlease contact an OSR Seminar Coordinator OR
Engineers who need to understand how to design, develop, maintain or test Windows drivers using the Windows Driver Model (WDM).
Developers who seek a thorough understanding of the workings of the Windows I/O subsystem, either in preparation for writing/maintaining a WDM driver or for gaining a stronger understanding of Windows architecture.
Important, Please Read: This seminar deals strictly with the Windows Driver Model (WDM) and does not prepare attendees for writing drivers using the Windows Driver Foundation. Most new driver development for Windows is done using the Windows Driver Foundation and not WDM. Therefore, most students who need to design or develop new Windows drivers should not select this seminar, but should rather attend OSR’s Writing WDF Drivers for Windows seminar.
Students who want to learn about writing File Systems for Windows are probably best served by attending OSR’s Windows Internals and Software Driver Development seminar, and not this seminar.
See “Which OSR Seminar is Right for Me” http://www.osr.com/seminar_choice.html -- If you have any questions about which seminar will best fit your needs, please contact an OSR Seminar Consultant by email or phone. We’re here to help!
Students attending this seminar must have a good working knowledge of O/S concepts in general (user mode versus kernel mode, virtual memory concepts, and concurrency issues) and Windows O/S architecture concepts in particular. Due to the hands-on orientation of this seminar, attendees will be assumed to be able to use Windows at a user level, including using Visual Studio (VC++). Working knowledge of the C programming language, and how to read and write to a file using Win32 (CreateFile, ReadFile, WriteFile) are also assumed.
Welcome remarks, seminar goals and objectives, and a brief introduction to Windows driver architectures.
- Windows Architecture
A brief review of Windows operating system architecture, focused specifically on the details needed by a WDM driver writer.
Windows Device Tree
A description of how the Windows PnP subsystem discovers and enumerates drivers, on both dynamically enumerable buses (such as PCI and USB) and non-dynamically enumerable Simple Peripheral Buses (SPBs, such as SPI, GPIO, and high speed serial buses). The role of Function Drivers, Bus Drivers, and Filter Drivers is discussed. PDOs, FDOs, and Filter Device Objects are defined. IRPs, I/O Stack Locations, and how requests are sent from driver to driver using IoCallDriver are all discussed. Synchronous and asynchronous IRP completion. A brief discussion of completion routines is also included.
In this section we discuss how to create installation control files for WDM and standard kernel mode device drivers. The Ten Most Frequently Used .INF File Sections are discussed.
Building and Debugging Kernel-Mode
This section describes how WDM drivers are built using the WDK build environment as well as the basics of how to setup and use the Windows kernel mode debugger, WinDbg.
- The DriverEntry and
AddDevice Entry Points
The two initial entry points in a driver are described. We also provide a description of the functions a driver typically calls within each of these routines, and do a walk-through of code from a sample driver for each of these entry points. PnP and WDM issues.
- Lab: Building and Debugging, Driver Initialization (DriverEntry, AddDevice, etc.
- PNP and
In this module, we take our first overall look at the Windows PnP state machine. Building on what we learned when we discussed the Device Tree, we describe how the PnP subsystem interacts with Function and Filter drivers. We describe how to process "bus first" and "function first" requests, and walk-through example code for handling IRP_MN_START_DEVICE requests.
Interrupt Levels & Deferred
In this module, we discuss the all-important concept of Interrupt Request Levels (IRQLs), and the specific uses that Windows makes of various IRQLs. We also discuss Deferred Procedure Calls (DPCs) and how they're used in Windows for Interrupt Service Routine completion (DPCforISR). We also discuss passive-level interrupts and its associated Work Item for ISR.
- Buffer Methods and IOCTL
In this section, the different ways that requestor data buffers can be described are discussed. Direct I/O, Buffered I/O and "Neither I/O" are described, compared, and contrasted. Also discussed is how to define custom Device IO Control Codes (IOCTLs), and how the previously described buffering methods apply to IOCTLs.
What it means to be "thread safe", and fully re-entrant. Serialization in kernel mode. Spin locks are defined, and the different types of spin locks are described. buffering methods apply to IOCTLs.
Dispatching and Completing
This module describes Dispatch Routines including I/O request validation, as well as the basics of request queuing and completion.
- Lab: Request Processing, Buffering and Queuing
- Programmed I/O
The HAL functions used by Windows drivers to access them. Review of the flow of an I/O Request for drivers that directly handle device interrupts.
Driver Verifier, PREfast, SDV
In this section, we explain how to use Windows Driver Verifier to test your driver is explained. Also covered are the roles of PREfast (PFD) and Static Driver Verifier. A number of driver debugging hints and tips are presented.
, Close, and Cancel
Cleanup, close and request cancellation are compared and contrasted. When one might need to implement support for each in a typical WDM driver is discussed. Guidelines for supporting request cancellation, including Cancel Safe Queues and in-progress request handling are presented
- Lab: Static Tools, Driver-to-Driver Communication
Windows power management concepts, as well as the responsibilities of the power policy owner, are discussed in this section. Proper handling of power transitions, interactions with PnP, starting and completing D-IRPs, and dealing with various failure situations are also discussed
A very detailed and important discussion of how Windows handles I/O completion. Why it is necessary to call IoMarkIrpPending and return STATUS_PENDING. When you must either return STATUS_PENDING or block in the dispatch routine if a completion routine reclaims an IRP with STATUS_MORE_PROCESSING_REQUIRED.
This module provides a short (about 2 hour) brain-dump of the basics of writing Windows drivers using KMDF. General architectural concepts, taxonomy, key KMDF Objects are discussed. The basics of how a KMDF driver is constructed is discussed, including Event Processing Callbacks. KMDF driver initialization, including an overview of KMDF’s unified PnP and Power Management implementation. An overview of how I/O requests are received and processed (WDFQUEUEs, dispatching types, and WdfCompleteRequest). Includes a brief walk-through of a simple KMDF driver.
- Lab: Cancel, Power, KMDF Driver Initialization (optional)
More on Seminars
What Our Students Say
- "One of the most lively and engaging seminar presentations on such a normally serious topic."
- "[Instructor] is a very good tutor. He presents the material with a (loud and) clear voice, often repeating stuff so one won't miss a thing. His long experience in the field shines through. When he got a question he could often refer to how it was designed and implemented in the Windows source code itself, and thus bringing a very clear and understandable answer."
- "It was an absolutely wonderful experience. [Instructor] knows the subject matter thoroughly, and can express the important points vividly and in easy to associate contexts. He is a very important player in the driver world, and made me feel very much welcome to this select community."
- "[Instructor] was able to explain everything we needed to know and explained complex stuff in an easy to understand way by simplifying information while still addressing the key goals. Excellent!"
- "I learned so much more in the week spent here than trying to learn on my own these past 4 years. I only wished I took the class back then. OSR continues to provide the best training experience we developers could wish for."