Windows Driver Model
About the Microsoft Windows Driver Model
The Windows Driver Model (WDM) was introduced to unify driver models across all versions of windows including Windows 98 and Windows 2000 and later. WDM drivers are IRP (I/O Request Packet) centric, using an in-memory packet structure to represent the I/O request on behalf of the issuing application. The Windows Driver Model uses a layered driver architecture to allow driver developers the ability to augment functionality of existing device drivers in the system. The Windows Driver Model exposes power management and Plug and Play (PnP) interfaces, allowing driver developers to selectively control how their devices consume power, and interact with the rest of the system. The Kernel Mode Driver Framework encapsulates much of WDM, often making it easier to write WDM drivers. However, a solid understanding of how WDM works is extremely useful when implementing and especially debugging non-trivial windows device drivers.
An excellent book on the Windows Driver Model is Walter Oney's Programming the Microsoft Windows Driver Model book. Though a few years old, much of it is still applicable to today's windows driver developer.
Working on a WDM or KMDF driver project? See our Windows driver development services or contact us to discuss your requirements.
Frequently Asked Questions
- What is the Windows Driver Model (WDM)?
- The Windows Driver Model is Microsoft's foundational kernel-mode driver architecture, introduced to unify driver development across Windows 98 and Windows 2000 and carried forward in every Windows version since. WDM defines how drivers are structured as a layered stack of device objects, how they receive and complete I/O Request Packets (IRPs), and how they participate in Plug and Play and power management. Higher-level frameworks like KMDF are built on top of WDM and abstract most of its complexity, but understanding WDM remains essential for debugging non-trivial drivers regardless of which framework was used to write them.
- Should I use WDM or KMDF for new driver development?
- For most new driver work, KMDF is the better starting point. KMDF handles PnP event sequences, power management state machines, I/O cancellation, and synchronization in ways that are correct by default, and it eliminates a large class of bugs that WDM drivers routinely encounter. Pure WDM is still appropriate when a driver needs direct control over IRP dispatch that KMDF does not expose, or when it must interoperate with legacy components that require specific WDM behavior.
- What is an IRP in Windows driver development?
- An IRP (I/O Request Packet) is the data structure Windows uses to represent a pending I/O operation as it travels through the driver stack. Each driver in the stack receives the IRP, optionally sets up a completion routine, and either completes it or passes it to the next lower driver. IRPs represent operations such as reads, writes, device control requests, and PnP and power management events. Correct IRP handling — including completion, cancellation, and forwarding — is one of the most error-prone aspects of WDM driver development.
- What is a WDM device stack?
- A WDM device stack is the vertical chain of device objects attached to a single physical or logical device. At the bottom sits the Physical Device Object (PDO) created by the bus driver. Above it, the Function Device Object (FDO) created by the functional driver handles the device's core behavior. Optional upper and lower filter device objects sit above and below the FDO respectively, allowing filter drivers to intercept I/O without modifying the functional driver. IRPs enter at the top of the stack and travel downward; each driver can inspect, modify, complete, or forward them.
Technologies
Developer Tools
What our customers say about us?
Read our customer testimonials to find out why our clients keep returning for their projects.
View Testimonials