So what the heck is a Windows Filter Driver?
(And why you should care to know)
Click here if you want to skip past the technical stuff and go straight to "How to Fix Filter Driver Problems"
You may be familiar with Windows devices and drivers. You might already know that a bad or missing device driver can cause Windows (and you!) all sorts of grief. But do you also know
- Filter drivers (simply called “filters”) are a special type of Windows driver
- Filters are optional drivers often used to extend, add value to or otherwise alter the behavior of a device
- Filters are supposed to work with and in-addition-to a device's main driver (called the function driver.) (and btw.. it's the function driver you're used to seeing when you open use Device Manager to first look at a device
- Windows tends to "hide" filters from you, the end-user (unless you know how to specifically look for and find them)
>> !!Yet filter problems can be the real cause of your CD/DVD, disk drive or sound/media device driver problem!!
Device Driver Overview (the view from 10,000 feet)
Windows 2000, XP and Vista provide a "layered" approach to device drivers. A device driver is software. It allows Windows to "talk" to and fully support a device
A device driver provides Windows (and Windows applications) the Input/Output (I/O) and control functions required to access and use a hardware device, such as a modem, network adapter or disk drive
>> Every device driver has a
function driver plus zero or more
filter drivers
>> Note diagram: Possible device driver "layers'' are yellow. The function driver is required. The dashed filters are optional
>> IRPs (I/O Request Packets) are sent down the I/O stack, and processed in the following order
Function Driver
>> Every device driver includes a
function driver
>> The
function driver provides the I/O and control functions needed to access and support a device
>> Specifically, it's the
function driver you're seeing when you open Windows Device Manager and first look at a device and its driver
Filter Drivers
>> A device driver can include zero or more filters
>> Filters intercept and
may modify the I/O Request Packets (
IRPs) exchanged between Windows or a Windows' application and a hardware device
>> Upper filters are always applied
before the function driver
>> Lower filters are always applied
after the function driver
- Upper vs. Lower Filters
- Upper filters intercept IRPs as the data flows between Windows or a Windows' application and the function driver
>> Upper filters typically provide added-value features for added-value features for a device (see examples
- Lower filters intercept IRPs as the data flows between a device's function driver and the device hardware
>> Lower filters typically modify the behavior of the device hardware (see examples)
- Lower and Upper Filter Examples
- A keyboard upper filter may intercept the keyboard data stream to implement additional security checks as the data passes between an application or OS/module and the keyboard's function driver
- A keyboard lower filter may intercept physical keystrokes to "clean-up" the keypresses sent between the keyboard hardware and its function driver. (You may have only pressed the hardware key once, but internally, the keypress may have made repeated physical electrical contact within a few milliseconds, sending more than one signal when only one was intended. A lower filter can recognize and clean-up the un-intended behavior, change the data stream received from the hardware and simply just 1 keystroke (as user intended) to the function driver) From the end-user's perspective, the see a one key-press response and all looks like a simple one press/one character response.
- Note About Keyboard Filter Examples
Note how a "layered" approach to device driver makes it easy to swap-out and change filter functionality (e.g. how security is being applied, or how mutli-press keystrokes are being handled). In our keyboard example, note that a simple change to upper filters can affect how security is applied in the device driver. The security change occurs without ever changing or even having to touch the keyboard function driver itself
- Device vs. Class Filters
Both Upper and Lower Filters can be installled at either the device level or at the class level
- A Device filter is applied to a single and specific device
- A Class filter is applied to all devices that belong to the same class as the class filter
Here's a just few of the many different Windows device classes
Code:
[B][U]CLASS[/U][/B] [B][U]Description[/U][/B]
CDROM CD and DVD drives
DiskDrive Disk drives
Keyboard Keyboards
MEDIA Sound, video and game controllers
- Example
>> If you install a class filter for DiskDrives, then this single filter will be applied to EVERY diskdrive installed on your compter
>> If you only install it on the device level (which is done by unique device ID), then it will only filter the exact device that you put it on originally and all other devices, even in the same class, will be unaffected
A filter logically sits above (upper filters) or below (lower filters) the function driver
- Upper filters
- Upper filters filter the data between an application/operating system service and a device's function driver
- Upper filters are applied BEFORE the function driver
- Example:
- Lower filters
- Lower filters filter data between the hardware itself and the function driver, providing extra security/stability or translating proprietary communication into a standard language for the main driver
- Lower filters are applied AFTER the function driver
Problems when a "filter chain" breaks
Information about your device's filter and function drivers are all kept in the registry. A "break" in the data flow (called a filter chain break) many reasons.. Just a few examples
>> Registry points to a corrupt or bad filter
>> Registry still points to a filter drive file disk file but the file no longer exists (e.g. An Uninstaller may delete the file but not modify your registry correctly
These problems can cause devices and/or drivers to fail
Why Class Filters are often a "hidden" problem
When you install a device its driver might include a Class filter. Thus this one device installs a filter that can affect every other device in that same class. (For example, a webcam driver can affect your sound card because they both belong to the same Windows Class of MEDIA
You might have recognized that devices in these 3 classes often have driver problems. So, for example, it's worth also noting that a single class filter for class=DISKDRIVE will be applied to every disk drive on your system.
>> In theory, that one class filter should work with all your disk drives but
>> It sometimes happens that it only works with some or even none of your devices
>> So the one class filter may cause just one or even all your disk device driver's to fail!
- Media class devices include sound cards and web cams
- CDROM class devices include includes CD and DVD devices
When the operating system or a software application issues an I/O request to a device
- Upper filters are applied to the request. Upper filters might modify the request
- The request is processed by the device driver. Upon completion, the driver sends a response
- Lower filters are applied to the response. Lower filters might modify the response
Below the "Device Driver Layers" there's "Bus Driver Layers" but i'm not going to address those at all
