Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Volume Dismount, Instance teardown and letter removals

Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589

Hi,

I am doing some testing with mounting of VHDs. DiskPart is used, a new VHD is created and assigned either a letter or a mount point (not both).
It seems random, but when the letter/mount point is removed, I get an instance teardown event, even though the volume is still there, we should not be getting an instance teardown right?

Regards, Dejan.

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,631

    Correct...If all that's happening is the deleting of the mount point then you shouldn't see an instance teardown. However, I don't know what else that code does. Maybe it tries to dismount the file system before removing the mount point?

    -scott
    OSR

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589
    via Email
    That would be random DiskPart behaviour then.
    All I do is call "REMOVE" on the assigned letter, and sometimes it calls
    teardown, sometimes not.
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,631

    I’m thinking that it might always try but it might not always work (e.g. a HANDLE open somewhere). Do you have a ProcMon trace?

    -scott
    OSR

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589
    via Email
    Peculiar,

    I get instance teardown, instance context Cleanup, but create file I/O
    keeps coming for the volume far after instance teardown, even though no new
    InstanceSetup is there...

    Some of these started aftet teardown.
  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589
    via Email
    And yep, I have ProcMon log.
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,631

    Do you see an FSCTL_DISMOUNT_VOLUME?

    -scott
    OSR

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589
    via Email
    No, the only i/o of interest is a LOCK volume.

    I debugged more and a new instance mount happens before the old instance
    teardown. That is why it looked like we get only a teardown, log did not
    imclude instance data on IRP MJ CREATE to be sure which instance is used.

    Now, IIRC, lock volume does this :( So the question remains why a new mount
    is always called before old teardown (though I can see this can happen..),
    and why it does not happen on most OSes :(

    Dejan.
  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,631

    There's no guarantee that you'll see a new instance only after an old teardown (e.g. the old instance can still be in use in the case of forced dismount or surprise removal).

    Is this behavior causing issues or just a curiosity?

    -scott
    OSR

  • Dejan_MaksimovicDejan_Maksimovic Member - All Emails Posts: 589
    via Email
    I think I identified a bug in my code, the assumption which occurs first.
    So, I think this is totally OK, just took time to figure.

    Thanks!
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 16-20 October 2023 Live, Online
Developing Minifilters 13-17 November 2023 Live, Online
Internals & Software Drivers 4-8 Dec 2023 Live, Online
Writing WDF Drivers 10-14 July 2023 Live, Online