Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi,
I am doing some testing with mounting of VHDs. DiskPart is used, a new VHD is created and assigned either a letter or a mount point (not both).
It seems random, but when the letter/mount point is removed, I get an instance teardown event, even though the volume is still there, we should not be getting an instance teardown right?
Regards, Dejan.
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 16-20 October 2023 | Live, Online |
Developing Minifilters | 13-17 November 2023 | Live, Online |
Internals & Software Drivers | 4-8 Dec 2023 | Live, Online |
Writing WDF Drivers | 10-14 July 2023 | Live, Online |
Comments
Correct...If all that's happening is the deleting of the mount point then you shouldn't see an instance teardown. However, I don't know what else that code does. Maybe it tries to dismount the file system before removing the mount point?
-scott
OSR
All I do is call "REMOVE" on the assigned letter, and sometimes it calls
teardown, sometimes not.
I’m thinking that it might always try but it might not always work (e.g. a HANDLE open somewhere). Do you have a ProcMon trace?
-scott
OSR
I get instance teardown, instance context Cleanup, but create file I/O
keeps coming for the volume far after instance teardown, even though no new
InstanceSetup is there...
Some of these started aftet teardown.
Do you see an FSCTL_DISMOUNT_VOLUME?
-scott
OSR
I debugged more and a new instance mount happens before the old instance
teardown. That is why it looked like we get only a teardown, log did not
imclude instance data on IRP MJ CREATE to be sure which instance is used.
Now, IIRC, lock volume does this
is always called before old teardown (though I can see this can happen..),
and why it does not happen on most OSes
Dejan.
There's no guarantee that you'll see a new instance only after an old teardown (e.g. the old instance can still be in use in the case of forced dismount or surprise removal).
Is this behavior causing issues or just a curiosity?
-scott
OSR
So, I think this is totally OK, just took time to figure.
Thanks!