MSDN Documentation

Understanding Driver Stacks in Windows Kernel I/O

In the Windows operating system, the I/O subsystem manages all communication between user-mode applications and hardware devices. A fundamental concept within this subsystem is the driver stack. Driver stacks provide a flexible and modular architecture for handling I/O requests, allowing for complex device interactions and the insertion of various software components that can intercept, modify, or augment I/O operations.

What is a Driver Stack?

A driver stack, also known as an I/O stack, is a hierarchical arrangement of device drivers that process an I/O request for a particular device. When an application or another driver sends an I/O request to a device, it is sent to the top-most driver in the stack for that device. This driver processes the request as much as it can and then passes it down to the next driver in the stack. This process continues until the request reaches the bottom-most driver, which is typically the filter driver or the function driver directly responsible for communicating with the hardware.

Components of a Driver Stack

A typical driver stack can include several types of drivers, layered on top of each other:

• Top-most Filter Drivers (Upper Filters): These drivers intercept I/O requests before they reach the function driver. They can be used for tasks like device-specific filtering, logging, or injecting new functionality.
• Function Driver: This is the primary driver responsible for managing the device's functionality. It understands the device's hardware capabilities and translates I/O requests into device-specific commands.
• Bottom-most Filter Drivers (Lower Filters): These drivers intercept I/O requests after they have been processed by the function driver (or upper filters) but before they reach the PnP Manager or the bus driver. They can be used for tasks like performance monitoring or modifying data before it's sent to the hardware.
• Bus Driver: This driver manages the bus on which the device resides (e.g., PCI, USB). It handles device enumeration and control for devices on that bus.

How I/O Requests Flow

I/O requests travel down the stack to the device and then their I/O Response Routines travel back up the stack. This bi-directional flow allows for complex handling:

1. An application or system component sends an I/O request packet (IRP) to the I/O Manager.
2. The I/O Manager identifies the correct driver stack for the target device and sends the IRP to the top-most driver.
3. Each driver in the stack examines the IRP. It can:
   • Complete the IRP if it handles the request entirely.
   • Modify the IRP and pass it down to the next driver.
   • Pass the IRP down without modification.
   • Complete the IRP after the next driver has processed it.
4. The IRP eventually reaches the function driver, which interacts with the hardware.
5. Once the hardware operation is complete, the function driver (or the driver that initiated the hardware operation) completes the IRP and sends it back up the stack.
6. Drivers processing the IRP on its way up can perform actions based on the completion status or modify the results before passing it further up.

Benefits of Driver Stacks

• Modularity: Each driver handles a specific aspect of I/O processing, making the system easier to develop, debug, and maintain.
• Extensibility: New functionality can be added by inserting new filter drivers into existing stacks without modifying the original drivers.
• Reusability: Common I/O processing components can be developed as separate drivers and reused across different device stacks.
• Flexibility: Allows for sophisticated scenarios like device emulation, network redirectors, and advanced security features.

Key Concepts

• IRP (I/O Request Packet): The primary data structure used to communicate I/O operations within the kernel.
• Device Object: Represents a physical or logical device in the system. Each driver creates device objects for the devices it manages.
• Driver Object: Represents a loaded device driver.
• Device Stack: The collection of device objects that process I/O for a particular device.