How to set up a thread callback?Hi,
I noticed that on W2K the system unloads a driver by calling ZwUnloadDriver. However, a breakpoint on this this function wont hit under XP. So what API does XP call to unload a driver?
Thanks in advance.
Jicun
> Jicun Zhong wrote:
I noticed that on W2K the system unloads a driver by calling
ZwUnloadDriver. However, a breakpoint on this this function wont hit
under XP. So what API does XP call to unload a driver?
What problem are you trying to solve? I.e., why do you care what
internal path the system is taking to accomplish this task?
–
Walter Oney, Consulting and Training
Basic and Advanced Driver Programming Seminars
Now teaming with John Hyde for USB Device Engineering Seminars
Check out our schedule at http://www.oneysoft.com
Maybe he is just courious how things work ?? Is this a capital sin ?
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 12:18 PM
Subject: [ntdev] Re: Driver unload on XP
> > Jicun Zhong wrote:
> > I noticed that on W2K the system unloads a driver by calling
> > ZwUnloadDriver. However, a breakpoint on this this function wont hit
> > under XP. So what API does XP call to unload a driver?
>
> What problem are you trying to solve? I.e., why do you care what
> internal path the system is taking to accomplish this task?
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
Dan Partelly wrote:
Maybe he is just courious how things work ?? Is this a capital sin ?
Did I say it was? People often ask the wrong question here. I.e., they
wander down some rathole searching for a solution to some problem and
conclude that they could solve it if only they could “X”, for suitable
choices of “X”. It often helps to step back and look at the original
problem.
–
Walter Oney, Consulting and Training
Basic and Advanced Driver Programming Seminars
Now teaming with John Hyde for USB Device Engineering Seminars
Check out our schedule at http://www.oneysoft.com
I am keeping track of all the miniports loaded in the system for test
purpose. However some miniports does not unload after it’s halted. So the
best cleanup is to intercept the service function that kicks the driver out
of the memory. Of course there are semi-optimal solutions. Like checking all
the loaded system modules(a pooling scheme) or just keep the data and free
it util next time the miniport is loaded again.
Yes, I ask the question mainly for the curiosity why XP stoped to use
ZwUnloadDriver.
Jicun
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 1:14 PM
Subject: [ntdev] Re: Driver unload on XP
> Dan Partelly wrote:
> > Maybe he is just courious how things work ?? Is this a capital sin ?
>
> Did I say it was? People often ask the wrong question here. I.e., they
> wander down some rathole searching for a solution to some problem and
> conclude that they could solve it if only they could “X”, for suitable
> choices of “X”. It often helps to step back and look at the original
> problem.
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
Jicun Zhong wrote:
I am keeping track of all the miniports loaded in the system for test
purpose. However some miniports does not unload after it’s halted. So the
best cleanup is to intercept the service function that kicks the driver out
of the memory. Of course there are semi-optimal solutions. Like checking all
the loaded system modules(a pooling scheme) or just keep the data and free
it util next time the miniport is loaded again.
Is this in user- or kernel-mode? How broad is your concept of
“miniport”, given that a good many device architectures use
class/minidriver pairs? Have you looked into the various user- and
kernel-mode forms of PnP notification to see if they would help?
–
Walter Oney, Consulting and Training
Basic and Advanced Driver Programming Seminars
Now teaming with John Hyde for USB Device Engineering Seminars
Check out our schedule at http://www.oneysoft.com
Break on MmUnloadSystemImage() , the core routine which free a PE image from
system memory. ( Most of the time , as a result of a reference
count on a driver object droping to 0, or reference count on a kernel DLL
reach 0) By examining the call
stack , youll easily see the call hierarchy and see what XP at a higher
level then this API.
As far as I recall, for a kernel mode DLL to be unloaded when all references
to it are gone,
implementing DllUnload method is mandatory.
----- Original Message -----
From: “Jicun Zhong”
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 5:19 PM
Subject: [ntdev] Re: Driver unload on XP
> I am keeping track of all the miniports loaded in the system for test
> purpose. However some miniports does not unload after it’s halted. So the
> best cleanup is to intercept the service function that kicks the driver
out
> of the memory. Of course there are semi-optimal solutions. Like checking
all
> the loaded system modules(a pooling scheme) or just keep the data and free
> it util next time the miniport is loaded again.
> Yes, I ask the question mainly for the curiosity why XP stoped to use
> ZwUnloadDriver.
>
> Jicun
>
> ----- Original Message -----
> From: “Walter Oney”
> Newsgroups: ntdev
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 1:14 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > Dan Partelly wrote:
> > > Maybe he is just courious how things work ?? Is this a capital sin ?
> >
> > Did I say it was? People often ask the wrong question here. I.e., they
> > wander down some rathole searching for a solution to some problem and
> > conclude that they could solve it if only they could “X”, for suitable
> > choices of “X”. It often helps to step back and look at the original
> > problem.
> >
> > –
> > Walter Oney, Consulting and Training
> > Basic and Advanced Driver Programming Seminars
> > Now teaming with John Hyde for USB Device Engineering Seminars
> > Check out our schedule at http://www.oneysoft.com
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
Sorry, I mean NDIS miniports. i have not tried to register a notification
for those miniports which sit on a PnP bus. Those miniport usualy unload
after being halted. The problem is mainly for those virtual miniports which
is not related to any HW and probably participate in some other third party
stack(extra references). My basic understanding is no matter what, after all
the reference count on the driver/deviceObj are gone, and its unload routine
is called the system should queue a workitem to the system thread and on
this workitem callback it calls something like ZwUnloadDriver. I just wonder
how XP unloads a driver without calling ZwUnloadDriver.
Jicun
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 4:45 PM
Subject: [ntdev] Re: Driver unload on XP
> Jicun Zhong wrote:
> > I am keeping track of all the miniports loaded in the system for test
> > purpose. However some miniports does not unload after it’s halted. So
the
> > best cleanup is to intercept the service function that kicks the driver
out
> > of the memory. Of course there are semi-optimal solutions. Like checking
all
> > the loaded system modules(a pooling scheme) or just keep the data and
free
> > it util next time the miniport is loaded again.
>
> Is this in user- or kernel-mode? How broad is your concept of
> “miniport”, given that a good many device architectures use
> class/minidriver pairs? Have you looked into the various user- and
> kernel-mode forms of PnP notification to see if they would help?
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>> how XP unloads a driver without calling ZwUnloadDriver
Remember that NtUnloadDriver is just a system call, mainly a highest level
wrapper for some other calls.
Theorethically , it’s enough that ref cnt on a driver object drop to 0, that
DriverObject delete methods
to be called , and the image discarded from memory. You dont need an
explicit ZwUnload().
----- Original Message -----
From: “Jicun Zhong”
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 6:11 PM
Subject: [ntdev] Re: Driver unload on XP
> Sorry, I mean NDIS miniports. i have not tried to register a notification
> for those miniports which sit on a PnP bus. Those miniport usualy unload
> after being halted. The problem is mainly for those virtual miniports
which
> is not related to any HW and probably participate in some other third
party
> stack(extra references). My basic understanding is no matter what, after
all
> the reference count on the driver/deviceObj are gone, and its unload
routine
> is called the system should queue a workitem to the system thread and on
> this workitem callback it calls something like ZwUnloadDriver. I just
wonder
> how XP unloads a driver without calling ZwUnloadDriver.
>
> Jicun
>
> ----- Original Message -----
> From: “Walter Oney”
> Newsgroups: ntdev
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 4:45 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > Jicun Zhong wrote:
> > > I am keeping track of all the miniports loaded in the system for test
> > > purpose. However some miniports does not unload after it’s halted. So
> the
> > > best cleanup is to intercept the service function that kicks the
driver
> out
> > > of the memory. Of course there are semi-optimal solutions. Like
checking
> all
> > > the loaded system modules(a pooling scheme) or just keep the data and
> free
> > > it util next time the miniport is loaded again.
> >
> > Is this in user- or kernel-mode? How broad is your concept of
> > “miniport”, given that a good many device architectures use
> > class/minidriver pairs? Have you looked into the various user- and
> > kernel-mode forms of PnP notification to see if they would help?
> >
> > –
> > Walter Oney, Consulting and Training
> > Basic and Advanced Driver Programming Seminars
> > Now teaming with John Hyde for USB Device Engineering Seminars
> > Check out our schedule at http://www.oneysoft.com
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
For PnP drivers, ZwUnloadDriver will not work. They are unloaded
automatically after the last of their device objects was removed.
Max
----- Original Message -----
From: “Jicun Zhong”
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 6:19 PM
Subject: [ntdev] Re: Driver unload on XP
> I am keeping track of all the miniports loaded in the system for
test
> purpose. However some miniports does not unload after it’s halted.
So the
> best cleanup is to intercept the service function that kicks the
driver out
> of the memory. Of course there are semi-optimal solutions. Like
checking all
> the loaded system modules(a pooling scheme) or just keep the data
and free
> it util next time the miniport is loaded again.
> Yes, I ask the question mainly for the curiosity why XP stoped to
use
> ZwUnloadDriver.
>
> Jicun
>
> ----- Original Message -----
> From: “Walter Oney”
> Newsgroups: ntdev
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 1:14 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > Dan Partelly wrote:
> > > Maybe he is just courious how things work ?? Is this a capital
sin ?
> >
> > Did I say it was? People often ask the wrong question here. I.e.,
they
> > wander down some rathole searching for a solution to some problem
and
> > conclude that they could solve it if only they could “X”, for
suitable
> > choices of “X”. It often helps to step back and look at the
original
> > problem.
> >
> > –
> > Walter Oney, Consulting and Training
> > Basic and Advanced Driver Programming Seminars
> > Now teaming with John Hyde for USB Device Engineering Seminars
> > Check out our schedule at http://www.oneysoft.com
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
No, it calls MmUnloadSystemImage.
ZwUnloadDriver is “net stop drivername”, it is not used at all for PnP
drivers and will fail for them if used.
Max
----- Original Message -----
From: “Jicun Zhong”
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 7:11 PM
Subject: [ntdev] Re: Driver unload on XP
> Sorry, I mean NDIS miniports. i have not tried to register a
notification
> for those miniports which sit on a PnP bus. Those miniport usualy
unload
> after being halted. The problem is mainly for those virtual
miniports which
> is not related to any HW and probably participate in some other
third party
> stack(extra references). My basic understanding is no matter what,
after all
> the reference count on the driver/deviceObj are gone, and its unload
routine
> is called the system should queue a workitem to the system thread
and on
> this workitem callback it calls something like ZwUnloadDriver. I
just wonder
> how XP unloads a driver without calling ZwUnloadDriver.
>
> Jicun
>
> ----- Original Message -----
> From: “Walter Oney”
> Newsgroups: ntdev
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 4:45 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > Jicun Zhong wrote:
> > > I am keeping track of all the miniports loaded in the system for
test
> > > purpose. However some miniports does not unload after it’s
halted. So
> the
> > > best cleanup is to intercept the service function that kicks the
driver
> out
> > > of the memory. Of course there are semi-optimal solutions. Like
checking
> all
> > > the loaded system modules(a pooling scheme) or just keep the
data and
> free
> > > it util next time the miniport is loaded again.
> >
> > Is this in user- or kernel-mode? How broad is your concept of
> > “miniport”, given that a good many device architectures use
> > class/minidriver pairs? Have you looked into the various user- and
> > kernel-mode forms of PnP notification to see if they would help?
> >
> > –
> > Walter Oney, Consulting and Training
> > Basic and Advanced Driver Programming Seminars
> > Now teaming with John Hyde for USB Device Engineering Seminars
> > Check out our schedule at http://www.oneysoft.com
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
miniport drvier is not a real driver in the sense it does not own a device
object. It is a slave of its port driver, which owns the device object. I
don’t know what do you mean by a virtual NDIS miniport. If it does not have
hardware, why it is not intermediate NDIS driver? NDIS miniport mandatory
registered halt routine will be called by its port driver if the port driver
is removed based IRP_MJ_PNP/IRP_MN_QUERY_REMOVE_DEVICE and
IRP_MN_REMOVE_DEVICE or IRP_MN_SURPRISE_REMOVAL. Therefore you cannot just
kick miniport driver out.
You can call IoRegisterPlugPlayNotification if you want to monitor driver
removal.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Tuesday, December 03, 2002 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Sorry, I mean NDIS miniports. i have not tried to register a notification
for those miniports which sit on a PnP bus. Those miniport usualy unload
after being halted. The problem is mainly for those virtual miniports which
is not related to any HW and probably participate in some other third party
stack(extra references). My basic understanding is no matter what, after all
the reference count on the driver/deviceObj are gone, and its unload routine
is called the system should queue a workitem to the system thread and on
this workitem callback it calls something like ZwUnloadDriver. I just wonder
how XP unloads a driver without calling ZwUnloadDriver.
Jicun
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 4:45 PM
Subject: [ntdev] Re: Driver unload on XP
> Jicun Zhong wrote:
> > I am keeping track of all the miniports loaded in the system for test
> > purpose. However some miniports does not unload after it’s halted. So
the
> > best cleanup is to intercept the service function that kicks the driver
out
> > of the memory. Of course there are semi-optimal solutions. Like checking
all
> > the loaded system modules(a pooling scheme) or just keep the data and
free
> > it util next time the miniport is loaded again.
>
> Is this in user- or kernel-mode? How broad is your concept of
> “miniport”, given that a good many device architectures use
> class/minidriver pairs? Have you looked into the various user- and
> kernel-mode forms of PnP notification to see if they would help?
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%
RE: [ntdev] Re: Driver unload on XPHi Bi,
Well an NDIS miniport will at least have a device object created by NDIS, in case of need, the miniport can also create another device object via NdisMRegisterDevice to communicate directly with some user apps. NDIS miniports are the lowest driver in the NDIS world dealing with HW. I am not quite sure the port driver you mentioned, is that something on the WDM side of NDIS-WDM drivers? Virtual NDIS miniport is quite popular in e.g. VPN solutions. They are just a normal miniport pretend to have a HW but actually not. They are loaded as NDIS group. Those WDM Irps donot go directly into the Ndis miniports, Ndis manage them for the miniports and calls miniport through the Ndis interface. I am not try to kick out a miniport. I just want to detect the event that a miniport is being kicked out of memory. I am not sure IoRegisterPlugPlayNotification will detect the virtual miniport’s unload.
Jicun
----- Original Message -----
From: Bi Chen
To: NT Developers Interest List
Sent: Tuesday, December 03, 2002 11:54 PM
Subject: [ntdev] Re: Driver unload on XP
miniport drvier is not a real driver in the sense it does not own a device object. It is a slave of its port driver, which owns the device object. I don’t know what do you mean by a virtual NDIS miniport. If it does not have hardware, why it is not intermediate NDIS driver? NDIS miniport mandatory registered halt routine will be called by its port driver if the port driver is removed based IRP_MJ_PNP/IRP_MN_QUERY_REMOVE_DEVICE and IRP_MN_REMOVE_DEVICE or IRP_MN_SURPRISE_REMOVAL. Therefore you cannot just kick miniport driver out.
You can call IoRegisterPlugPlayNotification if you want to monitor driver removal.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Tuesday, December 03, 2002 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Sorry, I mean NDIS miniports. i have not tried to register a notification
for those miniports which sit on a PnP bus. Those miniport usualy unload
after being halted. The problem is mainly for those virtual miniports which
is not related to any HW and probably participate in some other third party
stack(extra references). My basic understanding is no matter what, after all
the reference count on the driver/deviceObj are gone, and its unload routine
is called the system should queue a workitem to the system thread and on
this workitem callback it calls something like ZwUnloadDriver. I just wonder
how XP unloads a driver without calling ZwUnloadDriver.
Jicun
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 4:45 PM
Subject: [ntdev] Re: Driver unload on XP
> Jicun Zhong wrote:
> > I am keeping track of all the miniports loaded in the system for test
> > purpose. However some miniports does not unload after it’s halted. So
the
> > best cleanup is to intercept the service function that kicks the driver
out
> > of the memory. Of course there are semi-optimal solutions. Like checking
all
> > the loaded system modules(a pooling scheme) or just keep the data and
free
> > it util next time the miniport is loaded again.
>
> Is this in user- or kernel-mode? How broad is your concept of
> “miniport”, given that a good many device architectures use
> class/minidriver pairs? Have you looked into the various user- and
> kernel-mode forms of PnP notification to see if they would help?
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntdev as: xxxxx@vallcom.com
To unsubscribe send a blank email to %%email.unsub%%
Hi Max,
But on W2K if I yank a PCMCIA based NIC card, the system calls
ZwUnloadDriver and later MmUnloadSystemImage from a system work thread to
unload the driver. Does the fact that ZwUnloadDriver is not called on XP
means XP has “corrected” this behavior?
Since MmUnloadSystemImage is not exported, is there any way that I can
get a ptr to it apart from parsing the symbols? MmGetSystemRoutineAddress
wont work for unexported functions.
Jicun
----- Original Message -----
From: “Maxim S. Shatskih”
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 11:00 PM
Subject: [ntdev] Re: Driver unload on XP
> No, it calls MmUnloadSystemImage.
>
> ZwUnloadDriver is “net stop drivername”, it is not used at all for PnP
> drivers and will fail for them if used.
>
> Max
>
> ----- Original Message -----
> From: “Jicun Zhong”
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 7:11 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > Sorry, I mean NDIS miniports. i have not tried to register a
> notification
> > for those miniports which sit on a PnP bus. Those miniport usualy
> unload
> > after being halted. The problem is mainly for those virtual
> miniports which
> > is not related to any HW and probably participate in some other
> third party
> > stack(extra references). My basic understanding is no matter what,
> after all
> > the reference count on the driver/deviceObj are gone, and its unload
> routine
> > is called the system should queue a workitem to the system thread
> and on
> > this workitem callback it calls something like ZwUnloadDriver. I
> just wonder
> > how XP unloads a driver without calling ZwUnloadDriver.
> >
> > Jicun
> >
> > ----- Original Message -----
> > From: “Walter Oney”
> > Newsgroups: ntdev
> > To: “NT Developers Interest List”
> > Sent: Tuesday, December 03, 2002 4:45 PM
> > Subject: [ntdev] Re: Driver unload on XP
> >
> >
> > > Jicun Zhong wrote:
> > > > I am keeping track of all the miniports loaded in the system for
> test
> > > > purpose. However some miniports does not unload after it’s
> halted. So
> > the
> > > > best cleanup is to intercept the service function that kicks the
> driver
> > out
> > > > of the memory. Of course there are semi-optimal solutions. Like
> checking
> > all
> > > > the loaded system modules(a pooling scheme) or just keep the
> data and
> > free
> > > > it util next time the miniport is loaded again.
> > >
> > > Is this in user- or kernel-mode? How broad is your concept of
> > > “miniport”, given that a good many device architectures use
> > > class/minidriver pairs? Have you looked into the various user- and
> > > kernel-mode forms of PnP notification to see if they would help?
> > >
> > > –
> > > Walter Oney, Consulting and Training
> > > Basic and Advanced Driver Programming Seminars
> > > Now teaming with John Hyde for USB Device Engineering Seminars
> > > Check out our schedule at http://www.oneysoft.com
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
This only means that they moved some of the PnP’s functionality
from user to kernel mode. An implementation detail, as the whole
ZwUnloadDriver is.
Why you need such a solution? For testing, WinDbg’s breakpoint on
MmUnloadSystemImage is enough.
Max
----- Original Message -----
From: “Jicun Zhong”
To: “NT Developers Interest List”
Sent: Wednesday, December 04, 2002 11:54 AM
Subject: [ntdev] Re: Driver unload on XP
> Hi Max,
> But on W2K if I yank a PCMCIA based NIC card, the system calls
> ZwUnloadDriver and later MmUnloadSystemImage from a system work
thread to
> unload the driver. Does the fact that ZwUnloadDriver is not called
on XP
> means XP has “corrected” this behavior?
> Since MmUnloadSystemImage is not exported, is there any way that
I can
> get a ptr to it apart from parsing the symbols?
MmGetSystemRoutineAddress
> wont work for unexported functions.
>
> Jicun
>
> ----- Original Message -----
> From: “Maxim S. Shatskih”
> To: “NT Developers Interest List”
> Sent: Tuesday, December 03, 2002 11:00 PM
> Subject: [ntdev] Re: Driver unload on XP
>
>
> > No, it calls MmUnloadSystemImage.
> >
> > ZwUnloadDriver is “net stop drivername”, it is not used at all for
PnP
> > drivers and will fail for them if used.
> >
> > Max
> >
> > ----- Original Message -----
> > From: “Jicun Zhong”
> > To: “NT Developers Interest List”
> > Sent: Tuesday, December 03, 2002 7:11 PM
> > Subject: [ntdev] Re: Driver unload on XP
> >
> >
> > > Sorry, I mean NDIS miniports. i have not tried to register a
> > notification
> > > for those miniports which sit on a PnP bus. Those miniport
usualy
> > unload
> > > after being halted. The problem is mainly for those virtual
> > miniports which
> > > is not related to any HW and probably participate in some other
> > third party
> > > stack(extra references). My basic understanding is no matter
what,
> > after all
> > > the reference count on the driver/deviceObj are gone, and its
unload
> > routine
> > > is called the system should queue a workitem to the system
thread
> > and on
> > > this workitem callback it calls something like ZwUnloadDriver. I
> > just wonder
> > > how XP unloads a driver without calling ZwUnloadDriver.
> > >
> > > Jicun
> > >
> > > ----- Original Message -----
> > > From: “Walter Oney”
> > > Newsgroups: ntdev
> > > To: “NT Developers Interest List”
> > > Sent: Tuesday, December 03, 2002 4:45 PM
> > > Subject: [ntdev] Re: Driver unload on XP
> > >
> > >
> > > > Jicun Zhong wrote:
> > > > > I am keeping track of all the miniports loaded in the system
for
> > test
> > > > > purpose. However some miniports does not unload after it’s
> > halted. So
> > > the
> > > > > best cleanup is to intercept the service function that kicks
the
> > driver
> > > out
> > > > > of the memory. Of course there are semi-optimal solutions.
Like
> > checking
> > > all
> > > > > the loaded system modules(a pooling scheme) or just keep the
> > data and
> > > free
> > > > > it util next time the miniport is loaded again.
> > > >
> > > > Is this in user- or kernel-mode? How broad is your concept of
> > > > “miniport”, given that a good many device architectures use
> > > > class/minidriver pairs? Have you looked into the various user-
and
> > > > kernel-mode forms of PnP notification to see if they would
help?
> > > >
> > > > –
> > > > Walter Oney, Consulting and Training
> > > > Basic and Advanced Driver Programming Seminars
> > > > Now teaming with John Hyde for USB Device Engineering Seminars
> > > > Check out our schedule at http://www.oneysoft.com
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@vallcom.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>
NDIS is sort of legacy port driver. The device object got from
NdisRegisterDevice is not the device object that has a PDO under its stack,
i.e. not a FDO for a PDO. If you just want to know if the miniport is being
kicked out, you could implement an simple NDIS intermediate driver like
PassThru. Then when a miniport gets kicked out, your driver has to do the
unbinding of virtual adapter to real adaptor.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Wednesday, December 04, 2002 12:46 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Hi Bi,
Well an NDIS miniport will at least have a device object created by NDIS,
in case of need, the miniport can also create another device object via
NdisMRegisterDevice to communicate directly with some user apps. NDIS
miniports are the lowest driver in the NDIS world dealing with HW. I am not
quite sure the port driver you mentioned, is that something on the WDM side
of NDIS-WDM drivers? Virtual NDIS miniport is quite popular in e.g. VPN
solutions. They are just a normal miniport pretend to have a HW but actually
not. They are loaded as NDIS group. Those WDM Irps donot go directly into
the Ndis miniports, Ndis manage them for the miniports and calls miniport
through the Ndis interface. I am not try to kick out a miniport. I just want
to detect the event that a miniport is being kicked out of memory. I am not
sure IoRegisterPlugPlayNotification will detect the virtual miniport’s
unload.
Jicun
----- Original Message -----
From: Bi Chen mailto:xxxxx
To: NT Developers Interest List mailto:xxxxx
Sent: Tuesday, December 03, 2002 11:54 PM
Subject: [ntdev] Re: Driver unload on XP
miniport drvier is not a real driver in the sense it does not own a device
object. It is a slave of its port driver, which owns the device object. I
don’t know what do you mean by a virtual NDIS miniport. If it does not have
hardware, why it is not intermediate NDIS driver? NDIS miniport mandatory
registered halt routine will be called by its port driver if the port driver
is removed based IRP_MJ_PNP/IRP_MN_QUERY_REMOVE_DEVICE and
IRP_MN_REMOVE_DEVICE or IRP_MN_SURPRISE_REMOVAL. Therefore you cannot just
kick miniport driver out.
You can call IoRegisterPlugPlayNotification if you want to monitor driver
removal.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com mailto:xxxxx]
Sent: Tuesday, December 03, 2002 8:11 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Sorry, I mean NDIS miniports. i have not tried to register a notification
for those miniports which sit on a PnP bus. Those miniport usualy unload
after being halted. The problem is mainly for those virtual miniports which
is not related to any HW and probably participate in some other third party
stack(extra references). My basic understanding is no matter what, after all
the reference count on the driver/deviceObj are gone, and its unload routine
is called the system should queue a workitem to the system thread and on
this workitem callback it calls something like ZwUnloadDriver. I just wonder
how XP unloads a driver without calling ZwUnloadDriver.
Jicun
----- Original Message -----
From: “Walter Oney”
Newsgroups: ntdev
To: “NT Developers Interest List”
Sent: Tuesday, December 03, 2002 4:45 PM
Subject: [ntdev] Re: Driver unload on XP
> Jicun Zhong wrote:
> > I am keeping track of all the miniports loaded in the system for test
> > purpose. However some miniports does not unload after it’s halted. So
the
> > best cleanup is to intercept the service function that kicks the driver
out
> > of the memory. Of course there are semi-optimal solutions. Like checking
all
> > the loaded system modules(a pooling scheme) or just keep the data and
free
> > it util next time the miniport is loaded again.
>
> Is this in user- or kernel-mode? How broad is your concept of
> “miniport”, given that a good many device architectures use
> class/minidriver pairs? Have you looked into the various user- and
> kernel-mode forms of PnP notification to see if they would help?
>
> –
> Walter Oney, Consulting and Training
> Basic and Advanced Driver Programming Seminars
> Now teaming with John Hyde for USB Device Engineering Seminars
> Check out our schedule at http://www.oneysoft.com
http:
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntdev as: xxxxx@vallcom.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%</http:></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>
> ----------
From: xxxxx@AppStream.com[SMTP:xxxxx@AppStream.com]
Reply To: xxxxx@lists.osr.com
Sent: Wednesday, December 04, 2002 7:54 PM
To: xxxxx@lists.osr.com
Subject: [ntdev] Re: Driver unload on XPNDIS is sort of legacy port driver. The device object got from
NdisRegisterDevice is not the device object that has a PDO under its
stack, i.e. not a FDO for a PDO. If you just want to know if the miniport
is being kicked out, you could implement an simple NDIS intermediate
driver like PassThru. Then when a miniport gets kicked out, your driver
has to do the unbinding of virtual adapter to real adaptor.
It probably won’t work in all cases. IIRC there are situations when virtual
adapters are destroyed and miniport can still sit in memory. An example (it
is long time ago I played with it so I’m not quite sure): if driver creates
device(s) using NdisMRegisterDevice and then all its adapter are disabled,
they are destroyed standard way but driver remains in memory. Of cource, it
should destroy devices when the last virtual adapter is halted but if it
doesn’t, it won’t be unloaded until “net stop driver”.
Also, such an IM driver would have to bind to all existing miniports which
may be impossible and inefficient.
Best regards,
Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]
Michal has pointed out the exact points I want to say. Unload of virtual
miniports is the problem I want to solve. These virtual miniports usually
participate in some other activity and wont unload even if its miniport
identity is destroyed.
Jicun
----- Original Message -----
From: “Michal Vodicka”
To: “NT Developers Interest List”
Sent: Thursday, December 05, 2002 12:40 AM
Subject: [ntdev] Re: Driver unload on XP
> > ----------
> > From: xxxxx@AppStream.com[SMTP:xxxxx@AppStream.com]
> > Reply To: xxxxx@lists.osr.com
> > Sent: Wednesday, December 04, 2002 7:54 PM
> > To: xxxxx@lists.osr.com
> > Subject: [ntdev] Re: Driver unload on XP
> >
> > NDIS is sort of legacy port driver. The device object got from
> > NdisRegisterDevice is not the device object that has a PDO under its
> > stack, i.e. not a FDO for a PDO. If you just want to know if the
miniport
> > is being kicked out, you could implement an simple NDIS intermediate
> > driver like PassThru. Then when a miniport gets kicked out, your driver
> > has to do the unbinding of virtual adapter to real adaptor.
> >
> It probably won’t work in all cases. IIRC there are situations when
virtual
> adapters are destroyed and miniport can still sit in memory. An example
(it
> is long time ago I played with it so I’m not quite sure): if driver
creates
> device(s) using NdisMRegisterDevice and then all its adapter are disabled,
> they are destroyed standard way but driver remains in memory. Of cource,
it
> should destroy devices when the last virtual adapter is halted but if it
> doesn’t, it won’t be unloaded until “net stop driver”.
>
> Also, such an IM driver would have to bind to all existing miniports which
> may be impossible and inefficient.
>
> Best regards,
>
> Michal Vodicka
> STMicroelectronics Design and Application s.r.o.
> [michal.vodicka@st.com, http:://www.st.com]
>
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
I don’t know if user mode service or “undocument” kernel periodic pooling is
acceptable for you. There is a api allow you to obtain all the driver
loaded.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Thursday, December 05, 2002 12:32 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Michal has pointed out the exact points I want to say. Unload of virtual
miniports is the problem I want to solve. These virtual miniports usually
participate in some other activity and wont unload even if its miniport
identity is destroyed.
Jicun
----- Original Message -----
From: “Michal Vodicka”
To: “NT Developers Interest List”
Sent: Thursday, December 05, 2002 12:40 AM
Subject: [ntdev] Re: Driver unload on XP
> > ----------
> > From: xxxxx@AppStream.com[SMTP:xxxxx@AppStream.com]
> > Reply To: xxxxx@lists.osr.com
> > Sent: Wednesday, December 04, 2002 7:54 PM
> > To: xxxxx@lists.osr.com
> > Subject: [ntdev] Re: Driver unload on XP
> >
> > NDIS is sort of legacy port driver. The device object got from
> > NdisRegisterDevice is not the device object that has a PDO under its
> > stack, i.e. not a FDO for a PDO. If you just want to know if the
miniport
> > is being kicked out, you could implement an simple NDIS intermediate
> > driver like PassThru. Then when a miniport gets kicked out, your driver
> > has to do the unbinding of virtual adapter to real adaptor.
> >
> It probably won’t work in all cases. IIRC there are situations when
virtual
> adapters are destroyed and miniport can still sit in memory. An example
(it
> is long time ago I played with it so I’m not quite sure): if driver
creates
> device(s) using NdisMRegisterDevice and then all its adapter are disabled,
> they are destroyed standard way but driver remains in memory. Of cource,
it
> should destroy devices when the last virtual adapter is halted but if it
> doesn’t, it won’t be unloaded until “net stop driver”.
>
> Also, such an IM driver would have to bind to all existing miniports which
> may be impossible and inefficient.
>
> Best regards,
>
> Michal Vodicka
> STMicroelectronics Design and Application s.r.o.
> [michal.vodicka@st.com, http:://www.st.com]
>
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%
RE: [ntdev] Re: Driver unload on XPYes I know that API. Thank you!
Jicun
----- Original Message -----
From: Bi Chen
To: NT Developers Interest List
Sent: Thursday, December 05, 2002 7:04 PM
Subject: [ntdev] Re: Driver unload on XP
I don’t know if user mode service or “undocument” kernel periodic pooling is acceptable for you. There is a api allow you to obtain all the driver loaded.
Bi
-----Original Message-----
From: Jicun Zhong [mailto:xxxxx@vallcom.com]
Sent: Thursday, December 05, 2002 12:32 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Driver unload on XP
Michal has pointed out the exact points I want to say. Unload of virtual
miniports is the problem I want to solve. These virtual miniports usually
participate in some other activity and wont unload even if its miniport
identity is destroyed.
Jicun
----- Original Message -----
From: “Michal Vodicka”
To: “NT Developers Interest List”
Sent: Thursday, December 05, 2002 12:40 AM
Subject: [ntdev] Re: Driver unload on XP
> > ----------
> > From: xxxxx@AppStream.com[SMTP:xxxxx@AppStream.com]
> > Reply To: xxxxx@lists.osr.com
> > Sent: Wednesday, December 04, 2002 7:54 PM
> > To: xxxxx@lists.osr.com
> > Subject: [ntdev] Re: Driver unload on XP
> >
> > NDIS is sort of legacy port driver. The device object got from
> > NdisRegisterDevice is not the device object that has a PDO under its
> > stack, i.e. not a FDO for a PDO. If you just want to know if the
miniport
> > is being kicked out, you could implement an simple NDIS intermediate
> > driver like PassThru. Then when a miniport gets kicked out, your driver
> > has to do the unbinding of virtual adapter to real adaptor.
> >
> It probably won’t work in all cases. IIRC there are situations when
virtual
> adapters are destroyed and miniport can still sit in memory. An example
(it
> is long time ago I played with it so I’m not quite sure): if driver
creates
> device(s) using NdisMRegisterDevice and then all its adapter are disabled,
> they are destroyed standard way but driver remains in memory. Of cource,
it
> should destroy devices when the last virtual adapter is halted but if it
> doesn’t, it won’t be unloaded until “net stop driver”.
>
> Also, such an IM driver would have to bind to all existing miniports which
> may be impossible and inefficient.
>
> Best regards,
>
> Michal Vodicka
> STMicroelectronics Design and Application s.r.o.
> [michal.vodicka@st.com, http:://www.st.com]
>
> >
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@vallcom.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
—
You are currently subscribed to ntdev as: xxxxx@appstream.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to ntdev as: xxxxx@vallcom.com
To unsubscribe send a blank email to %%email.unsub%%