Ruediger R. Asche
Microsoft Developer Network Technology Group
November 1995
Following up on the Microsoft® Developer Network (MSDN) Library's "The Little Device Driver Writer," this article presents an overview of Microsoft Windows NT™ device driver programming and a comprehensive reading list.
Since the introduction of the Microsoft® Windows NT™ operating system, a lot has been written about how to use the Win32® Application Programming Interface (API), for which Windows NT has been the first publicly available host. However, the information available about the system architecture of that operating system (and, consequently, information about how to write device drivers) is still fairly sparse. This article presents a road map to the information that is available both on the MSDN Library CD and in third-party publications.
It is much more straightforward to write device drivers for Windows NT than it is to write drivers for Microsoft Windows® 95 because Windows NT is a designed operating system as opposed to Windows 95, which has evolved over time. For example, in Windows 95 an interrupt handler can be located in several places, whereas Windows NT has architectural provisions that do not allow interrupt handlers in user-mode code. Furthermore, Windows NT does not have a concept of an "interrupt chain," as Windows 95 has. In other words, there is exactly one place where an interrupt can be handled in Windows NT, and the semantics of interrupt handling are well defined.
Although the system architecture of Windows NT makes device driver writing a more predictable and well-defined (albeit somewhat more restricted) task than for Windows 95, writing a device driver for Windows NT is not necessarily easier than writing one for Windows 95.
This road map is designed to present you with all the information currently available (to the best of my knowledge) for Windows NT device driver writers. Analogous to "The VxD Writer's Resource Book, or VxD Writing as a Martial Art," I have organized the material in ascending order of difficulty so you can look for the information that is most appropriate for your level. You will probably want to go back and forth as you learn about writing device drivers and need to uncover information that is relevant to the driver you need to write.
As hard as I tried, I am sure that some important sources of information escaped me somewhere. If you know about useful pieces of information that for whatever reason fell through the cracks and didn't make it into this article, please let me know by using one of the following methods:
In this section, I've presented the sources of information necessary for you to get an idea of the Windows NT system architecture and how device drivers fit into the picture:
The indispensable primer to Windows NT architecture is the classic Inside Windows NT by Helen Custer (Redmond, WA: Microsoft Press, 1993).
The basic structure of the I/O system and the device driver architecture is outlined in the Kernel Mode Drivers Design Guide in the Windows NT 4.0 Device Driver Kit (DDK) (MSDN Library, DDK Documentation)
Check out "Windows NT Device Drivers: Into the NT Kernel" by Jamie Hanrahan in the NT Developer newsletter 2 (February 1995).
Also by Jamie Hanrahan, "Windows NT Device Drivers: Interrupts and Synchronization" in the NT Developer newsletter 2 (March 1995).
"The Little Device Driver Writer" technical article in the MSDN Library also provides a useful overview of driver design for Windows NT.
The following items provide additional information about aspects of the Windows NT system architecture. Throughout this article, all titles that start with a Q number are located in the Knowledge Base section of the MSDN Library. Other MSDN Library locations are indicated in parentheses after the title.
"Chapter 1: Windows NT Architecture" in the Windows NT 4.0 Resource Kit (MSDN Library, Windows Resource Kits)
Q100108, "Overview of FAT, HPFS, and NTFS File Systems"
Q126418, "Streams Transport Driver Support for Windows NT"
Q101501, "Differences Between a Service and a Device Driver"
Q100371, "Video Drivers (Three-Part Model)"
Q101503, "Reasons Windows NT Device Drivers Contain 'Trusted' Code"
Q102658, "Windows NT Does Not Provide IRQ Sharing"
Q101787, "General Information on Starting Multiple Operating Systems"
Q96015, "Streams Interface (TLI, XTI) Not Supported"
Q115757, "Direct Connected Network Printers Using DLC, IPX"
Q117894, "The Windows NT Parallel Driver"
Q121552, "FIX: Zw Calls Fail If KeyFullInformation Is a Parameter"
Q122438, "PRB: Error When Compiling: Missing header file PSHPACK4.H"
Q123254, "PRB: Problems Running Multiple HCT Managers"
Q126285, "FIX: Problem with GENPORT.C: PortAddress Not Initialized"
Q132897, "UNCONF: Missing Message Error When Starting Driver"
Q126547, "Floating Point Math Is Not Supported in a Kernel-Mode Driver"
Q120270, "Win32DDK/SDK Don't Contain What Is Necessary to Create an IFS"
Q124504, "Mixer Manager Incorporated into NT 3.5 SDK and DDK"
Here are a few more items that are not in the MSDN Library but are useful for background information.
Custer, Helen. Inside the Windows NT File System. Redmond, WA: Microsoft Press, 1994.
Merrit, Dennis. "Extending C with Prolog." Dr. Dobb's Journal (August 1994). [with a side note on network configuration management under Windows NT]
Tomlinson, Paula. "Windows NT File System Developer's Conference Report." Windows/DOS Developer's Journal 5 (December 1994).
The following articles from the Windows NT DDK Knowledge Base elaborate on specific issues concerning device driver writing:
Q101502, "Device Driver Start Codes"
Q115486, "Two Methods to Control Device Driver Load Order"
Q126416, "Cautions on Using METHOD_NEITHER IOCTL"
Q115758, "Meanings of Address Fields in an IRP Structure"
Q117308, "How Drivers Notify User-Mode Pgms of Asynchronous Events"
Q120170, "Creation and Destruction of File Objects"
Q120171, "I/O Request Packet (IRP) Cancellation"
Q126368, "Creating Device Objects in Dispatch Routines"
Q126415, "SAMPLE: Async Notification from Kernel Mode Driver"
Q126430, "BUG: Probs Using IoWriteErrorLogEntry to Write Error Messages"
Q121965, "How to Change Max Memory Allowed with MmProbeAndLockPages"
Q123460, "BUG: Interim Fix for IoAssignResource Fails When It Shouldn't"
Q126286, "SAMPLE: Using ZwCreateFile() to Open File from Kernel"
Q126414, "SAMPLE: Sequences & Uses of Kernel APIs to Operate Slave DMA"
This section lists what you need to know to build your first device driver, how to debug the driver, and so on.
Windows NT device drivers are normally written in C, possibly with a little assembly code supplementing the C code. The official supported way to write your driver is to install the Win32 Software Development Kit (SDK) first (this will supply the compiler and linker), install the assembler if need be, and then install the Windows NT DDK, which will provide you with the headers and libraries to build your drivers.
For information about the build environment (compiler and linker), please refer to the Win32 SDK documentation. Assemblers are documented by whoever ships them; for the Microsoft 32-bit assembler, see:
Macro Assembler 6.11 for Windows NT (32-bit) (Product Documentation, Languages)
You can also build your driver in C++ and use other compilers, such as Microsoft Visual C++™, to build your driver, but please note that Microsoft Product Support Services cannot help you with it. I wrote a series of experimental articles that help you utilize Visual C++ to build your drivers; once more, please do not expect Microsoft to provide support for the material covered in these articles. They are:
"The Windows NT Kernel-Mode Driver Cookbook, Featuring Visual C++"
"Writing Windows NT Kernel-Mode Drivers in C++"
"Wizards Simplify Windows NT Kernel-Mode Driver Design"
"Using the Windows NT Custom Driver Wizard"
In addition to the driver samples that are shipped with the Windows NT DDK, there are two other driver samples in the Library:
"KBDCLASS/MOUCLASS: Windows NT Kernel Mode Device Drivers Written in C++" (To access, use the sample button in "Writing Windows NT Kernel-Mode Drivers in C++" by Ruediger R. Asche)
"SERVICE: Creates and Installs a Service" (Sample Code, Product Samples)
The following Knowledge Base articles deal with debugging issues:
Q98890, "Debugging a Service with WinDbg"
Q115760, "Kernel Debugging Using WinDbg"
Q133301, "How to Debug User-Mode Drivers Using WinDbg and WinDbgRm"
Q126419, "Enabling Debug Output for OEMSETUP.INF Scripts"
Q89279, "Dumping Physical Addresses Under the Kernel Debugger"
Q128372, "How to Remove Symbols from Device Drivers"
Q90081, "Configuring a Kernel Debugger to Debug a Device Driver"
Q90082, "Debug Printing Implementation in the Device Drivers"
Q107727, "Debugging Printer Drivers with WINDBG and WINDBGRM"
Q113996, "Mapping NT Status Error Codes to Win32 Error Codes"
In this section, I've listed and organized the material that will be of interest to you if you are familiar with the basic structure and development cycle of device drivers and you want to tackle the real-world task of writing a "real" device driver.
"Writing User-Mode Windows NT Drivers for Alpha APX Platforms" (MSDN Library, Backgrounders, Platform Articles)
MIPS Programmer's Guide (MSDN Library Archive, Product Documentation, Languages, Visual C++ 2.0 Development System for MIPS)
Alpha AXP Programmer's Guide (MSDN Library Archive, Product Documentation, Languages, Visual C++ 2.0 Development System for Digital Alpha AXP)
Q135305, "BUG: VDDInstallMemoryHook Fails on Non-x86 Platforms"
Tomlinson, Paula. "Introduction to Virtual Device Drivers [for NT]." A three-part series in the NT Developer newsletter:
Q131454, "How to Take Advantage of Color Plane Ordering in Minidrivers"
Q121964, "Unidrivers: Convert Win 3.1 .RC Files to Win NT .RC Files"
Q116450, "BufferAccessScsiPortControlled Flag Information"
Q134908, "SCSI Miniport Data Transfer Restrictions for IDE Controllers"
Q126369, "FIX: Large Transfers Via SCSI Passthrough May Crash System"
Q133706, "How to Pass Parameters to a SCSI Miniport via the Registry"
Q123253, "SCSI Miniport SlotNumber Field Set by ScsiPortInitialize"
Q123677, "Unsupported SCSI Commands When Using SCSI Pass Through"
Q126431, "PRB: ScsiPortLogError May Not Log Multiple Errors"
Li, Sing. "Writing Non-SCSI-CD-ROM Device Drivers [for NT]." Dr. Dobb's Journal (March 1994).
Q89374, "Byte-Ordering in a Data Packet Under NDIS"
Q124079, "How to Allocate Non-Cached Memory for an NDIS Driver"
Q132690, "Kernel Mode Drivers Layered Under NDIS Miniport Drivers"
"Multimedia Technical Note: JPEG DIB Format" (MSDN Library Archive, Technical Articles, Multimedia Articles)
"Microsoft Messaging Application Program Interface (MAPI)" (MSDN Library Archive, Backgrounders and White Papers, Operating System Extensions)
"The Windows Telephony Application Programming Interface" (MSDN Library, Backgrounders, Platform Articles)
"Extended Capabilities Port (ECP) Specifications" (MSDN Library, Specifications)
"Windows Sockets Specification" (MSDN Library, Specifications, Platform)
SNA Device Interface Specification (MSDN Library, Platform SDK, Internet Networking and Distributed Services, SNA Server SDK)
"Windows NT, Windows for Workgroups, and Windows NT Advanced Server in a Novell NetWare Environment" (MSDN Library, Backgrounders, Platform, Kernel-Base)
Several of the articles I've listed are from the NT Developer newsletter. If you want to obtain copies of any of these articles, call (800) 234-0386 or (503) 747-0800.