Chapter 2.

Understanding Device Drivers

This chapter provides you with a general introduction to device drivers and takes you through the
structural elements of a device driver.

2.1 Device Driver Overview

Device drivers are the software segments that provide an interface between the operating system
and the specific hardware devices such as terminals, disks, tape drives, video cards and network
media. The device driver brings the device into and out of service, sets hardware parameters in
the device, transmits data from the kernel to the device, receives data from the device and passes
it back to the kernel, and handles device errors.

A driver acts like a translator between the device and programs that use the device. Each device
has its own set of specialized commands that only its driver knows. In contrast, most programs
access devices by using generic commands. The driver, therefore, accepts generic commands
from a program and then translates them into specialized commands for the device.

2.2 Classification of Drivers According to

Functionality
There are numerous driver types, differing in their functionality. This subsection briefly
describes three of the most common driver types.

2.2.1 Monolithic Drivers

Monolithic drivers are device drivers that embody all the functionality needed to support a
hardware device. A monolithic driver is accessed by one or more user applications, and directly
drives a hardware device. The driver communicates with the application through I/O control
commands (IOCTLs) and drives the hardware using calls to the different WDK, ETK, DDI/DKI
functions.

Figure 2.1 Monolithic Drivers

Monolithic drivers are supported in all operating systems including all Windows platforms and
all Unix platforms.

2.2.2 Layered Drivers

Layered drivers are device drivers that are part of a stack of device drivers that together process
an I/O request. An example of a layered driver is a driver that intercepts calls to the disk and
encrypts/decrypts all data being transferred to/from the disk. In this example, a driver would be
hooked on to the top of the existing driver and would only do the encryption/decryption.

Layered drivers are sometimes also known as filter drivers, and are supported in all operating
systems including all Windows platforms and all Unix platforms.

Figure 2.2 Layered Drivers

2.2.3 Miniport Drivers
A Miniport driver is an add-on to a class driver that supports miniport drivers. It is used so the
miniport driver does not have to implement all of the functions required of a driver for that class.
The class driver provides the basic class functionality for the miniport driver.
A class driver is a driver that supports a group of devices of common functionality, such as all
HID devices or all network devices.

Miniport drivers are also called miniclass drivers or minidrivers, and are supported in the
Windows NT (2000) family, namely Windows 7 / Vista / Server 2008 / Server 2003 / XP / 2000 /
NT 4.0.

Figure 2.3 Miniport Drivers

Windows 7/Vista/Server 2008/Server 2003/XP/2000/NT 4.0 provide several driver classes
(called ports) that handle the common functionality of their class. It is then up to the user to add
only the functionality that has to do with the inner workings of the specific hardware. The NDIS
miniport driver is one example of such a driver. The NDIS miniport framework is used to create
network drivers that hook up to NT's communication stacks and is therefore accessible to
common communication calls used by applications. The Windows NT kernel provides drivers
for the various communication stacks and other code that is common to communication cards.
Due to the NDIS framework, the network card developer does not have to write all of this code,
only the code that is specific to the network card he is developing.