driver load order

NTFSD
1

Hi,

Does anybody know if it’s possible to access files from within a DriverEntry
routine of a storage filter driver which boot order is SERVICE_BOOT_START? I
need to access at least the system volume

Also IFS Kit says (in “What Happens to File Systems During System Boot”
article):
“Then all drivers in the “filter” load order group are loaded. Note that the
“filter” group includes storage filter drivers as well as file system filter
drivers, and it includes third-party as well as built-in filter drivers.”

Does it mean that filesystem filter drivers may be loaded in the first order
and storage filter drivers after?

Thank you,
Roman

2

> Does anybody know if it’s possible to access files from within a

DriverEntry
routine of a storage filter driver which boot order is SERVICE_BOOT_START?
I
need to access at least the system volume
In my experience, it’s not possible. Filesystems become ready much later
[which looks reasonable - it’s hard to work with a file system on a disk
without a disk-:)]

Also IFS Kit says (in “What Happens to File Systems During System Boot”
article):
“Then all drivers in the “filter” load order group are loaded. Note that
the
“filter” group includes storage filter drivers as well as file system
filter
drivers, and it includes third-party as well as built-in filter drivers.”
Does it mean that filesystem filter drivers may be loaded in the first
order
and storage filter drivers after?
The order in which driver groups are loaded is determined by MULTI_SZ “List”
in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder,
which on my XP - with omissions - looks like

System Reserved
Boot Bus Extender
…
Primary Disk
SCSI Class
SCSI CDROM Class
FSFilter Infrastructure
<… a lot of other FS filters …>
FSFilter Activity Monitor
FSFilter Top
Filter
Boot File System
Base
<… a lot of other stuff …>

The order within each group is determined by Tags, as they are listed in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList.

Say, GroupOrderList contains a value “SCSI CDROM Class”
= REG_BINARY 02 00 00 00 02 00 00 00 01 00 00 00.

(translated from lowendian, this is 2; 2; 1).

It means that (probably) there are 2 drivers with Group=“SCSI CDROM Class”
in their service entries, one has Tag=1, another has Tag=2, and the driver
with
tag 2 will be loaded first.

If a device service entry refers to a Group but not to a Tag, the driver is
loaded after all tagged drivers in a group.

You can put a filter in an early-bird “Boot Bus Extender” group without a
tag to make sure that the driver is among the first to be loaded (the trick
VTrace uses, loading volume filters as untagged members of
“Boot Bus Extender” group). The bottom line is that a filter may belong to
any group, not just “Filter”.

Occasionally group / tag pairs coinside, I saw several drivers marked as
“Filter” with the same “Tag”=6.

Note that the load order has nothing to do with drivers’ functionality
(you attach to an existing device in your code, load order does not
do it for you).

Hope it helps.

Googling on GroupOrderList and/or ServiceGroupOrder will give more details,
I’m sure, check http://support.microsoft.com/?id=115486 for starters.

Regards,
Alex

3

> > Does anybody know if it’s possible to access files from within a

> DriverEntry
> routine of a storage filter driver which boot order is SERVICE_BOOT_START?
> I
> need to access at least the system volume
In my experience, it’s not possible. Filesystems become ready much later
[which looks reasonable - it’s hard to work with a file system on a disk
without a disk-:)]

Yes, I also think so, but IFS Kit gives inconsistent (not full) information: I can have a filesystem filter with SERVICE_BOOT_START order but FS recognizer is loaded at SERVICE_SYSTE_START time and IFS Kit says:

“The file system recognizer (FsRec) is loaded at this time (SERVICE_BOOT_START). Note that, although it is in the “Boot File System” load order group, FsRec is not the boot file system. The actual boot file system ? that is, the file system that mounted the boot volume ? is loaded at the start of the boot process.”.

But on another hand:

“On system boot, the OS loader loads the boot file system, the RAW file system, and all drivers of type SERVICE_BOOT_START BEFORE IT TRANSFERS CONTROL to the kernel. These drivers are in memory when the kernel gets control”

…

Moreover it says later:
"
…
2. The I/O Manager creates a global file system queue with four segments: one each for CD-ROM, disk, tape, and network file systems. Later, when each file system is registered, its control device objects are added to the appropriate segments of this queue. At this point, however, no file systems have yet been registered, so the queue is empty.
3. The PnP Manager calls the DriverEntry routines of the RAW file system and all SERVICE_BOOT_START drivers.
If a SERVICE_BOOT_START driver is dependent on other drivers, those drivers are loaded and started as well."

So my storage filter should be in memory along with the boot file system when the control is transferred to the kernel, shouldn’t it?
What is the purpose for ServiceGroupOrder and GroupOrderList if a driver doesn’t get control until all other boot drivers are loaded???
Are these values used to determine the order in which PnP maanger calls DriverEntry?

Do I miss something?

Thank you,
Roman

4

“Loaded” and “DriverEntry called” are different things for Boot drivers.

Loaded - by NTLDR before jumping to the kernel.
DriverEntry called - after jumping to the kernel and in the order specified by the ServiceGroupOrder.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Roman Kudinov
Newsgroups: ntfsd
To: Windows File Systems Devs Interest List
Sent: Wednesday, June 22, 2005 10:49 AM
Subject: Re:[ntfsd] driver load order

> Does anybody know if it’s possible to access files from within a
> > DriverEntry
> > routine of a storage filter driver which boot order is SERVICE_BOOT_START?
> > I
> > need to access at least the system volume
> In my experience, it’s not possible. Filesystems become ready much later
> [which looks reasonable - it’s hard to work with a file system on a disk
> without a disk-:)]

Yes, I also think so, but IFS Kit gives inconsistent (not full) information: I can have a filesystem filter with SERVICE_BOOT_START order but FS recognizer is loaded at SERVICE_SYSTE_START time and IFS Kit says:

“The file system recognizer (FsRec) is loaded at this time (SERVICE_BOOT_START). Note that, although it is in the “Boot File System” load order group, FsRec is not the boot file system. The actual boot file system ? that is, the file system that mounted the boot volume ? is loaded at the start of the boot process.”.

But on another hand:

“On system boot, the OS loader loads the boot file system, the RAW file system, and all drivers of type SERVICE_BOOT_START BEFORE IT TRANSFERS CONTROL to the kernel. These drivers are in memory when the kernel gets control”

…

Moreover it says later:
"
…
2. The I/O Manager creates a global file system queue with four segments: one each for CD-ROM, disk, tape, and network file systems. Later, when each file system is registered, its control device objects are added to the appropriate segments of this queue. At this point, however, no file systems have yet been registered, so the queue is empty.
3. The PnP Manager calls the DriverEntry routines of the RAW file system and all SERVICE_BOOT_START drivers.
If a SERVICE_BOOT_START driver is dependent on other drivers, those drivers are loaded and started as well."

So my storage filter should be in memory along with the boot file system when the control is transferred to the kernel, shouldn’t it?
What is the purpose for ServiceGroupOrder and GroupOrderList if a driver doesn’t get control until all other boot drivers are loaded???
Are these values used to determine the order in which PnP maanger calls DriverEntry?

Do I miss something?

Thank you,
Roman

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Roman,

You should never open a file from the driver entry routine of any boot
loaded driver in any of the “filter” groups. Doing this causes strange
problems which are very hard to track down.

When this is done it causes the volume you are accessing (probably the
boot volume) to mount prematurely. When this occurs the volume is not
setup with the proper state.

I have debugged these types of issues in the past and they are hard to
track down.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
Rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roman Kudinov
Sent: Tuesday, June 21, 2005 10:32 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] driver load order

Hi,

Does anybody know if it’s possible to access files from within a
DriverEntry
routine of a storage filter driver which boot order is
SERVICE_BOOT_START? I
need to access at least the system volume

Also IFS Kit says (in “What Happens to File Systems During System Boot”
article):
“Then all drivers in the “filter” load order group are loaded. Note that
the
“filter” group includes storage filter drivers as well as file system
filter
drivers, and it includes third-party as well as built-in filter
drivers.”

Does it mean that filesystem filter drivers may be loaded in the first
order
and storage filter drivers after?

Thank you,
Roman

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

> When this is done it causes the volume you are accessing (probably the

boot volume) to mount prematurely. When this occurs the volume is not
setup with the proper state.

Let me ask one more question - Could I try to open the symbolic link
first to make sure that the volume is mounted and then, If I am able to
open the link, can I expect that the volume has been already properly
mounted ?

L.