Windows – How Windows uses .inf files to load the correct drivers

computer-architecturedriversinfwindows

What happens when a hardware device matches two or more inf files when Windows is loading the drivers for that devices?

For example, the disk drive in my PC has two drivers loaded for it, cdrom.sys and iaStorF.sys. cdrom.sys was loaded from the cdrom.inf file and iaStorF.sys was loaded from the oem2.inf file that I installed from Intel.

Does Windows search all inf files and load anything that matches?

If so which is the 'primary INF file', what I mean by this in Device Manager when I click on the disk drive and go to the 'Details' tab, and then look at inf name, it shows cdrom.inf file, even though it also matched oem2.inf.

If I then look at my monitor, which also has two drivers for it loaded from two inf files, oem22.inf and monitor.inf. Under 'Details' and inf name, it shows oem22.inf.

Why did it choose oem22.inf over monitor.inf?

Best Answer

Its actually one main driver. The other one you see is a filter driver -- iaStorF.sys, where F means filter.

A filter driver is a Microsoft Windows driver that extends or modifies the function of peripheral devices or supports a specialized device in the personal computer. It is a driver or program or module that is inserted into the existing driver stack to perform some specific function.(wikipedia)

Here is a screenshot of my system, for disk drives, its in

HKLM\System\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}

enter image description here

The main driver is disk.sys, the other 3 are all filter drivers, EhStoreClass.sys and partmgr.sys are default MS drivers in Windows 8, edevmon.sys is from eset.

For monitors, the additional inf is optional, used for extending the capacity, like color profile(.icm) or EDID information, these inf are not required for monitor to operate, only monitor.sys is necessary. (MSDN)

Some more info about filter driver, I'll just reproduce it here for future reference.(MSDN)

Filter drivers are optional drivers that add value to or modify the behavior of a device. A filter driver can service one or more devices. Bus Filter Drivers

Bus filter drivers typically add value to a bus and are supplied by Microsoft or a system OEM (see the Possible Driver Layers figure). Bus filter drivers are optional. There can be any number of bus filter drivers for a bus.

A bus filter driver could, for example, implement proprietary enhancements to standard bus hardware.

For devices described by an ACPI BIOS, the power manager inserts a Microsoft-supplied ACPI filter (bus filter driver) above the bus driver for each such device. The ACPI filter carries out device power policy and powers on and off devices. The ACPI filter is transparent to other drivers and is not present on non-ACPI machines. Lower-Level Filter Drivers

Lower-level filter drivers typically modify the behavior of device hardware (see the Possible Driver Layers figure). They are typically supplied by IHVs and are optional. There can be any number of lower-level filter drivers for a device.

A lower-level device filter driver monitors and/or modifies I/O requests to a particular device. Typically, such filters redefine hardware behavior to match expected specifications.

A lower-level class filter driver monitors and/or modifies I/O requests for a class of devices. For example, a lower-level class filter driver for mouse devices could provide acceleration, performing a nonlinear conversion of mouse movement data. Upper-Level Filter Drivers

Upper-level filter drivers typically provide added-value features for a device (see the Possible Driver Layers figure). Such drivers are usually provided by IHVs and are optional. There can be any number of upper-level filter drivers for a device.

An upper-level device filter driver adds value for a particular device. For example, an upper-level device filter driver for a keyboard could enforce additional security checks.

An upper-level class filter driver adds value for all devices of a particular class.

Related Question