upper volume filter driver

NTDEV
1

I am a newbie to windows driver and learning to write an upper volume filter driver.
i would like to understand, upon installing , how the upper volume filter driver gets attached to the existing volume stack and to the new the volume (added post installation of the filter drivers) stack. ie) how does the filter driver attaches to the volume stack dynamically.

There is a very old code of upper volume filter driver i had come across, where it is mentioned that to attach to existing volumes (volumes created before installing the driver) the system requires a reboot. Is this true even now?

my upper volume filter driver is meant to track the change blocks of the volume (CBT)

2

You’ve kind of summarized things. Windows driver stacks are built from the bottom up. A driver can only be attached at the top of the stack. You can’t insert a driver in the middle; those drivers already know where to send IRPs and there’s no way to change their minds. When you “install” a filter, you are telling the system (via the registry) where you’d like to be loaded, but unless that location is currently the top of the stack, you won’t be able to load until the next boot, when the whole stack is built up again from the bottom up.

1 Like
3

Thanks Tim. As per my reading from ‘https://www.osr.com/nt-insider/2019-issue1/the-state-of-windows-file-system-filtering-in-2019/’ we have filter manager, that helps in dynamic loading for filesystem filter driver. Is there some thing available/applicable for volume filter drivers too.

4

No there is not. The FS filter manager behavior is unique to the FS layer of the stack. And while it has layering and that sounds like pnp filters, they are entirely different underneath the covers. Pnp has a static model and builds the stack as the device is started. Once started, there are no layering changes from pnp’s POV.

1 Like