If by “loading” one means “the order in which the binary image is
relocated into memory” then one doesn’t CARE the order in which your
filter is loaded relative to the boot file system driver.
The issue is the order of initialization. The bootstrap loader will
load all boot drivers (which can include file system filter drivers)
into memory based upon the information in the registry. The order is
actually up to the bootstrap implementation, and the boot file system
driver is not used in that process (there’s a separate library used by
the bootstrap loader that understands how to read the boot file system
format - hence there is one bootstrap loader per bootable file system.)
Once the OS and boot drivers are loaded into memory, the bootstrap
loader calls the OS initialization routine; further initialization is
done by the OS from that point forward.
The order of initialization for boot file systems is determined by the
registry, and until the storage stack is initialized, no other drivers
can even be loaded. If you want your filter driver to load before the
boot file system, you will need to add it to a group that loads prior to
the boot file system group - see the registry key
HKLM\System\CurrentControlSet\Control\ServiceGroupOrder for the
canonical list used for group ordering on your specific box. You will
notice there are groups prior to the “Boot File System” group, and
drivers in these groups are initialized prior to the boot file system.
If you set up the registry property - so that it is marked as a boot
start driver (and hence loaded by the bootstrap loader) and so that the
OS initializes your filter prior to the boot file system (using the
appropriate group,) you will observe the boot file system mount and load
and your filter will be called at its registration change notification
entry point.
Note that the rules for PnP drivers are different - these are the rules
for root bus drivers (PnP) and legacy drivers.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Francesco
Sent: Sunday, October 30, 2005 8:21 AM
To: ntfsd redirect
Subject: Re:[ntfsd] IoRegisterFsRegistrationChange and Windows 2000
It is clear. I suspected the volume containing the OS is loaded
always before the filter, but some messages in OSR list suggested
something different.
So, in windows 2000, I have to look for already mounted file systems (or
volumes). At the moment I search for volumes using a
IOCTL_MOUNTMGR_QUERY_POINTS.
I think a better approach is to:
- look for NTFS and FAT (the OS is in one of those)
- list all the volumes that use the boot FS.
Do you know how to list all the volumes for a file system?
Also, do you know if the paging file can be open after the
driver initializes? In windows XP it is called after.
Thanks, Francesco
Francesco,
What exactly is the question? You stated:
"To my understanding, in Windows 2000 the
IoRegisterFsRegistrationChange works
only for file systems loaded after the call.
Looking at the OSR mail-list, seems that if the driver start-up is
boot, it should load before any file system."
Regarding your above statement, the default file system which contains
your OS installation will
of course always load before your filter; how else could your boot be
successful? The basic OS components must be read off disk and loaded
before ever thinking of loading your filter. Once the
OS is loaded, your driver will be initialized and
“IoRegisterFsRegistrationChange works only for file systems loaded
after the call”
will remain a true; IoRegisterFsRegistrationChange isn’t called until
after the system’s filesystem is loaded and your driver is initialized
(generalizing there).
Your work around isn’t really a work around, the rules regarding
IoRegisterFsRegistrationChange remain the same as above.
IoRegisterFsRegistrationChange in 2000 will recognize Raw media,
whereas in XP and above it will not.
At least, that is my take on it…
M
With that said, IoRegisterFsRegistrationChange is following the rule
you pointed out…
Francesco Garelli wrote:
> Hi,
>
> I am writing a filter that loads at boot time. To my understanding,
> in Windows 2000 the
> IoRegisterFsRegistrationChange works only for file systems loaded
> after the
> call.
>
> Looking at the OSR mail-list, seems that if the driver start-up is
> boot, it
> should load before any
> file system. Anyway using the following settings, my driver always
> loads after NTFS is mounted.
> Honestly this makes sense, because Windows must load C: before
> loading my driver.
>
> I found a quick work-around. In the DriverEntry I try to attach
> mounted volumes. Some volumes
> contain only the RAW FS.
>
> Can you help me? Thanks
>
>
> Class =3D “OpenFileBackup” ;This is determined by the work this
> filter driv=
> er
> does
> ClassGuid =3D {f8ecafa6-66d1-41a5-899b
> -66585d7216b7} ;This value is determi=
> ned
> by the Class
> LoadOrderGroup =3D “FSFilter Bottom”
>
>
> ServiceType =3D 2 ;SERVICE_FILE_SYSTEM_DRIVER
> StartType =3D 0 ;SERVICE_BOOT_START
> ErrorControl =3D 1 ;SERVICE_ERROR_NORMAL
> LoadOrderGroup =3D “FSFilter Bottom”
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@comcast.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com