Do Windows drivers really need to run in kernel mode?

NTDEV
1

Hi
I have a conceptual question. I hope you help me to find the answer.
Do we have to write drivers in kernel mode just for performance reasons?
Or there is no other way, because of fundamental computer science principles?

2

Windows supports user mode drivers for all sorts of devices. There is no fundamental computer science principle that restricts device drivers to kernel mode.

2 Likes
3

The UM / KM boundary is a security boundary. There are many drivers that simply accept requests from an upper level driver (or UM program) and send requests to lower level driver(s). This kind can be implemented in UM because nothing that they do requires privileged instructions or direct hardware access. Drivers that do those things have to be implemented in KM because those operations can't be done in UM

1 Like
4

Think of proprietary embedded system like a microcontroller running a big while(1) loop then an interrupt occurs. The interrupt cannot be processed if it does not run at a higher priority.

Kernel mode manages hardware priorities, including interrupts operating at a higher priority, mind you I have only written drivers for PCIe devices. So this is my own personal take on this.

5

Mr. @Mark_Roddy is exactly right. In addition to the option of writing (many) drivers in user mode, there are plenty of operating systems where the drivers run exclusively in user mode. I've even worked on a couple. This isn't a new thing, either... the Mach kernel (which dates back to mid 1980's) had user-mode drivers.

6

If we are going to go beyond Windows, then it should be noted that the modern concepts of UM and KM are two specific privilege levels (rings) and that on other platforms many others have existed. With drivers and system components of different sorts being implemented at different levels depending on the design.

security boundaries of various sorts are still the primary consideration for most designs. But as usual, it depends

1 Like
7

I have written user mode drivers that are shared between Windows and Linux. There is still a kernel mode driver that is OS specific but it is very lightweight. It mostly just allows the user mode driver to map memory regions (in my case DMA space or PCI BARs) to user space and handle interrupts. So while there is still a kernel mode driver the bulk of the logic is executing in user mode.

1 Like