Section 13: Driver Dependencies

The Big Picture: A Row of Dominoes

You cannot cook without gas, and the gas needs a pipe. In the same way, a driver rarely works alone. Your SSD driver needs the PCIe bus driver underneath it. The file system needs the disk driver. A USB keyboard needs a USB hub, which needs a USB controller, which needs the PCIe bus. If one piece at the bottom is missing, everything above it fails, like dominoes.

This section looks at two kinds of connections: drivers that need other drivers (13.1) and filter drivers sitting in a chain (13.2).

13.1 Driver-to-Driver Dependencies

What it is: A dependency means "driver A can't work until driver B is there." There are several ways Windows tracks this.

1. Dependencies recorded in the registry. In a driver's key HKLM\SYSTEM\CurrentControlSet\Services\<name> you can find values such as:

If the thing it depends on can't start, this driver won't start either. You can see the same list for services in the Services app (Properties → Dependencies tab). That is the same mechanism you met in Chapter 12.

2. Dependencies from the device tree. The device tree (Section 7) is a dependency map in itself. A child device can only exist if its parent works:

   PCI Express Root Complex  (PCI bus driver)
        │
        └─ USB xHCI Host Controller  (USB controller driver)
              │
              └─ USB Root Hub  (USB hub driver)
                    │
                    └─ HID Keyboard  (HID / keyboard drivers)

If the xHCI controller's driver fails, every USB device underneath it disappears. That is why a single failed bus driver can make many devices vanish at once. In Device Manager, Devices by connection helps you find the parent that is the real culprit.

3. Dependencies by function calls: libraries and support drivers. Some drivers use code from other drivers or from kernel libraries:

A driver that calls functions exported by another driver (a kernel-mode DLL-like arrangement) has an import on it. Windows loads the other driver first, automatically.

4. Ordering at boot. As Section 6 explained, boot-start drivers, the load order groups, and tags make sure that the most basic drivers (bus, disk, file system) are loaded before others.

What breaks when a dependency is missing?

Windows tip. To see how drivers relate, run in PowerShell:

Get-Service | Where-Object { $_.ServiceType -match 'Driver' } | Select-Object -First 10 Name, Status, StartType

(This shows driver "services." It only reads information.) You can also use sc qc <drivername> in Command Prompt (for example sc qc disk) to see the dependencies and start type of one driver.

13.2 Filter Driver Chains

What it is: In Section 4.6 you learned that filter drivers sit above or below the main driver. When several filters exist at once, they form a chain. A request passes through the chain, one filter after another, in a fixed order.

A chain on the file system side (the most common place you meet them):

   Your program: "open report.docx"
             │
             ▼
   ┌─────────────────────────────┐
   │ Antivirus filter            │  scans the file as it is opened
   ├─────────────────────────────┤
   │ Backup / snapshot filter    │  notes the change for a backup
   ├─────────────────────────────┤
   │ Encryption filter           │  decrypts the data on its way up
   ├─────────────────────────────┤
   │ NTFS (file system driver)   │
   ├─────────────────────────────┤
   │ Volume / partition drivers  │
   ├─────────────────────────────┤
   │ Disk driver                 │
   └─────────────────────────────┘
             │
             ▼
           SSD

Altitudes. File system filters are managed by the Filter Manager (fltmgr.sys), a Microsoft driver that orders the filters. Every filter has a number called an altitude. A higher altitude = closer to the top (nearer to the application). Microsoft assigns altitude ranges to kinds of filter: for example, one range for antivirus, one for encryption, and one for backup. This makes the order the same on every PC, no matter which filters you install first.

See your own filter chain (safe, read-only): open Command Prompt as administrator and type:

fltmc

Example output (the names and numbers on your PC will differ):

Filter Name                     Num Instances    Altitude    Frame
------------------------------  -------------  ------------  -----
bindflt                                 1       409800         0
WdFilter                                7       328010         0
storqosflt                              0       244000         0
wcifs                                   0       189900         0
FileCrypt                               0       141100         0
luafv                                   1       135000         0
npsvctrig                               1        46000         0
Wof                                     3        40700         0
FileInfo                                7        45000         0

WdFilter is Microsoft Defender's filter. A third-party antivirus would add its own line. fltmc only lists. Do not use fltmc unload unless you are sure what you are doing.

Device-stack filters (non-file-system) are shown by the UpperFilters and LowerFilters registry entries (Section 4.6), for example under a device class key.

Why chains are both powerful and fragile:

Practical advice:

1. Run only one real-time antivirus.
2. After a crash, look for the driver named by the blue screen: it is often a filter (antivirus, disk encryption, VPN or backup software).
3. Keep third-party drivers updated; old filter drivers are a common cause of slow boots and crashes.

Summary