Each kernel-mode driver is constructed around a set of system-defined, standard driver routines. Kernel-mode drivers process I/O request packets (IRPs) within these standard routines by calling system-supplied driver support routines.
All drivers, regardless of their level in a chain of attached drivers, must have a basic set of standard routines in order to process IRPs. Whether a driver must implement additional standard routines depends on whether the driver controls a physical device or is layered over a physical device driver, as well as on the nature of the underlying physical device. Lowest-level drivers that control physical devices have more required routines than higher-level drivers, which typically pass IRPs to a lower driver for processing.
Standard driver routines can be divided into two groups: those that each kernel-mode driver must have, and those that are optional, depending on the driver type and location in the device stack.
The following table lists required standard routines.
|Required routines||Purpose||Where described|
|DriverEntry||Initializes the driver and its driver object.||Writing a DriverEntry Routine|
|AddDevice||Initializes devices and creates device objects.||Writing an AddDevice Routine|
|Dispatch Routines||Receive and process IRPs.||Writing Dispatch Routines|
|Unload||Release system resources acquired by the driver.||Writing an Unload Routine|
Each driver must have a DriverEntry routine, which initializes driver-wide data structures and resources. The I/O manager calls the DriverEntry routine when it loads the driver. A DriverEntry routine returns an NTSTATUS value, either STATUS_SUCCESS or an appropriate error status.
The current IRP and target device object are input parameters to many standard routines. Every driver processes each IRP in stages through its set of standard routines.
By convention, the system-supplied drivers prepend an identifying, driver-specific or device-specific prefix to the name of every standard routine except DriverEntry. As an example, this documentation uses “DD”, as shown in the illustration in Introduction to Driver Objects. Following this convention makes it easier to debug and maintain drivers.