Kernel-mode Driver Framework !link!

| Feature | Windows Driver Model (WDM) | Kernel-Mode Driver Framework (KMDF) | | :--- | :--- | :--- | | | High; requires deep kernel knowledge. | Moderate; framework handles boilerplate. | | Power Management | Manual; requires handling complex IRP_MJ_POWER IRPs. | Automatic; handled via simple event callbacks. | | Synchronization | Manual locking; high risk of race conditions. | Configurable synchronization scope; safer. | | Boilerplate Code | Thousands of lines of standard code required. | Minimal setup required. | | Risk of Crashes | High (direct memory access). | Lower (object encapsulation and verification). |

KMDF provides a unified interface for communicating with other drivers or hardware, known as "I/O Targets."

Instead of a single dispatch table, you create multiple objects with configurable dispatching: kernel-mode driver framework

(part of WDF, introduced with Windows Vista) is a Microsoft-provided abstraction layer that fundamentally rewrites the rules for writing Windows kernel drivers. It replaces the archaic, terrifyingly complex Windows Driver Model (WDM) with an object-oriented, event-driven, and state-machine-based framework.

One of the most painful aspects of WDM was managing IRP (I/O Request Packet) queues and handling synchronization. KMDF automates this. | Feature | Windows Driver Model (WDM) |

: Represents a device instance and handles PnP and power events. WDFQUEUE : Manages I/O requests.

| | Use Case | KMDF vs. That | | :--- | :--- | :--- | | WDM (legacy) | Maximum control, minimal dependencies | KMDF wins. Only use WDM for filter drivers needing bit-exact IRP layering. | | UMDF (User-Mode Driver Framework) | Drivers that can tolerate page faults (USB, sensors, printers) | KMDF is for high-performance, low-latency, or DMA-driven hardware. UMDF crashes don't BSOD, but have higher latency. | | Miniport models (NDIS, StorPort) | Network or storage hardware | You cannot use KMDF for these – they have their own framework. | | Linux Driver Model | Cross-platform | KMDF is more object-oriented and has better PnP state machines. Linux has simpler entry but more raw pointer chaos. | | Automatic; handled via simple event callbacks

– A mandatory, excellent framework for serious Windows kernel driver development. Just accept that you will still need to understand kernel internals; KMDF won't hide everything, but it will save your sanity.