Section 6: Disk Drivers

The Big Picture: From "Read This" to Electrical Signals

Section 1 showed the whole stack. Now we zoom into the bottom three layers: the ones that finally talk to the real hardware. These are all drivers: programs that run in kernel mode and know how to control a device. (Drivers and IRPs are explained in Chapter 13.)

The bottom of the stack has a clever design: one standard top, one standard middle, and a small custom bottom.

┌───────────────────────────────────────────────┐
│ Disk class driver   disk.sys                  │  same for every disk
├───────────────────────────────────────────────┤
│ Storage port driver storport.sys              │  same for most controllers
├───────────────────────────────────────────────┤
│ Miniport driver     stornvme.sys / storahci.sys│  one per controller type
╞═══════════════════════════════════════════════╡
│ Hardware: NVMe SSD, SATA drive, USB bridge ...│
└───────────────────────────────────────────────┘

Why this design? Microsoft writes the hard, shared parts once (the queues, the timers, the error handling). A hardware maker, or Microsoft for common controllers, only writes a small miniport for the details of one chip. That makes drivers shorter and safer.

6.1 The Disk Class Driver (disk.sys)

What it is: A class driver handles everything that is the same for a whole class of devices. disk.sys is the class driver for disks. It does not care whether the disk is a spinning hard drive, a SATA SSD, an NVMe SSD, or a USB drive. To it, every disk is a long row of numbered blocks.

What it does:

Does one disk.sys serve every disk? One driver, many instances: Windows creates one device object per disk, all run by the same driver code.

6.2 Port and Miniport Drivers (storport)

What it is: The port driver (storport.sys) is the "shared engine" below the class driver. A miniport driver plugs into it and knows one hardware family.

Storport's jobs (common to all controllers):

The miniports you will meet:

(usbstor.sys is not a storport miniport in the strict sense, but it fills the same "talk to the hardware" role for USB.)

Windows tip: Open Device Manager → Storage controllers and Disk drives. You will see "Standard NVM Express Controller" under controllers, and your SSD's brand name under Disk drives. Right-click one, choose Properties → Driver → Driver Details to see the real driver file names.

6.3 Talking to AHCI and NVMe Controllers

Both are controllers: small chips (or parts of a chip) that sit between the CPU and the storage device. The miniport does not move wires; it writes numbers into the controller's registers and into queues in RAM.

AHCI (SATA):

• A device-side chip called the HBA (Host Bus Adapter) sits in the chipset (the PCH from Chapter 4).
• It supports one command queue per port with up to 32 commands waiting (called NCQ, Native Command Queuing).
• This design was made when hard drives were slow, and it becomes a bottleneck for very fast SSDs.

NVMe (PCIe SSD):

• Built for flash memory and the PCIe bus.
• It supports up to 65,535 queues, each up to 65,536 commands deep (the maximum the specification allows; real SSDs use far fewer). Typically Windows uses one pair of queues per CPU core, so cores do not fight for a lock.
• Each queue pair has a submission queue (requests going to the SSD) and a completion queue (answers coming back).

What happens for one command (NVMe style):

1. Miniport writes the command into a submission queue in RAM
2. Miniport "rings the doorbell": writes the new queue position into
   a register on the SSD (MMIO, from Chapter 4)
3. The SSD fetches the command from RAM by itself (DMA)
4. The SSD reads the flash and writes the data into the buffer in RAM (DMA)
5. The SSD writes a "done" note into the completion queue
6. The SSD sends an interrupt (MSI-X) to the CPU core that asked
7. The driver's interrupt handler marks the request complete;
   the IRP travels back up

This is the DMA and interrupt story from Chapter 4 in action. The CPU does not copy a single byte of the file: it only sends the order and receives the "done" tap.

Here is a real NVMe SSD, the kind of hardware these drivers talk to:

Figure 20.4 — A Samsung 980 PRO NVMe SSD (M.2 stick). stornvme.sys talks to the controller chip on this board over PCIe, using queues in RAM and DMA. Photo: D-Kuru, CC BY-SA 4.0, via Wikimedia Commons.

(More about the SSD itself is in Chapter 18.)

6.4 When Things Go Wrong: Resets and Timeouts

Drivers are also the place where hardware trouble shows up.

Tip: Press Win + X, choose Event Viewer, then open Windows Logs → System and filter by source disk, storahci or stornvme. Repeated entries are an early warning that a drive or cable is failing. Back up first.

Summary