A Basic Vocabulary

This book often uses the term "driver" rather than "device driver" because device drivers are not the only type of driver. A class of drivers known as software drivers works in much the same way as device drivers but do not manage a device. Filter drivers are the most common driver in this category.

To help you build a basic vocabulary for driver development, here are a few terms that you'll find useful as you read further. See the glossary at the back of this book and the comprehensive glossary in the WDK for definitions of additional terms.

• arbitrary thread

  The thread that happens to be running on a processor when the system borrows the thread to run a driver routine, such as an ISR. The driver routine does not know which process owns the thread.

• bug check

  An error that is generated when core Windows data structures have been irretrievably corrupted, sometimes referred to as a system crash. Bug checks are generated only by misbehaving kernel-mode processes. When a bug check occurs, the system shuts down as gracefully as it can and, on some versions of Windows, displays a blue screen. The system can also be configured to create a crash-dump file that can be analyzed later with a kernel debugger.

• checked build

  A build used only for testing and debugging purposes.

• deferred procedure call (DPC)

  A routine that can be queued by code running at DIRQL to continue processing at DISPATCH_LEVEL.

• device driver interface (DDI)

  A collection of system-supplied routines that the driver calls to interact with kernel services. DDI is basically the driver equivalent of API. DDI routines normally have a prefix that indicates their use. For example, KMDF routines are named WdfXxx, and UMDF methods are exposed through COM interfaces named IWDFXxx.

• device object

  An object that represents a driver's participation in the processing of I/O requests for a particular device.

• device stack

  A collection of device objects and associated drivers that handle communication with a particular device.

• devnode

  An element of the PnP manager's device tree. The PnP uses a device stack's devnode to store configuration information and track the device.

• driver package

  An installation package that includes the driver and supporting files.

• framework object

  An object managed by WDF.

• free build

  A build used for released products.

• I/O completion routine

  A driver routine that runs when an I/O request has been completed by a lower driver in the stack.

• I/O control (IOCTL)

  A type of I/O request used to communicate with a driver for any reason other than reading from or writing to the device. For example, an application might use an IOCTL to change the device configuration or get the driver's version number.

• I/O request packet (IRP)

  An object used to pass a packet of data and related information between the I/O manager and the components of a device stack. IRPs are also used for non-I/O purposes, such as carrying notifications from the PnP manager. A closely related term is PIRP, which is a pointer to an IRP. WDF drivers usually do not deal with IRPs directly, so this book uses request object rather than IRP for most purposes.

• INF

  A text file that contains data used to install a driver.

• interrupt

  A notification to the system that something has occurred outside normal thread processing, such as a hardware event, that must be handled as soon as possible.

• interrupt request level (IRQL)

  A level that Windows assigns to each interrupt. In case of conflict, the interrupt with the higher IRQL has priority and the routine that handles it runs first.

• interrupt service routine (ISR)

  A routine implemented by a device driver to handle hardware interrupts.

• interrupt spin lock

  A synchronization object that can be used at DIRQL.

• kernel dispatcher object

  A collection of synchronization objects that can be used at PASSIVE_LEVEL.

• kernel mode

  A mode that gives processes the same privileges and risks as the Windows core operating system.

• kernel object

  An encapsulated data structure that is managed by the kernel's object manager.

• memory pool

  Equivalent to heap.

• nonpageable memory

  Memory that belongs to the nonpaged pool.

• nonpaged pool

  A heap that always remain in memory and is never paged out to disk.

• NTSTATUS

  A type that is used as a return value by many kernel-mode routines.

• object manager

  A kernel service that manages kernel objects.

• page fault

  An event that occurs when a process attempts to access a memory page that has been paged out.

• pageable memory

  Memory that belongs to the paged pool.

• paged out

  Memory that has been temporarily written to the hard drive until it is needed again.

• paged pool

  A heap that can be written to the hard drive if necessary and then read back in when needed.

• service routine

  A routine that handles processing for an interrupt.

• spin lock

  A synchronization object that can be used at DISPATCH_LEVEL.

• synchronization object

  Objects used to protect access to resources, such as events, semaphores, mutexes, and spin locks.

• SYS

  The file extension used for kernel-mode driver binaries. Although similar to DLLs, .sys files usually lack direct exports.

• user mode

  A restricted operating mode in which applications and UMDF drivers run that does not permit direct access to core Windows routines or data structures.

• work item

  A mechanism used by high-IRQL routines to have some of their processing performed at PASSIVE_LEVEL.