Legacy Driver Unload problems.

NTDEV
1

I have been working on a legacy driver that attaches to the CdRom devices to filter IOCTLs in Device_Control. All of this works as expected but I have problem that I seem be be having a hard time locating. The problem is reproduced by starting my driver at say system startup and then either creating a new USB style CD or by inserting a CD to read that causes the udfs file system to attach to the CD device. If I stop my driver it looks as though it works fine but the next time I try and start it I get “[SC] StartService FAILED 2” and the only way I have been able to restart the driver is to reboot the machine. If I just burn CD’s or don’t do anything, I can stop and start the driver as many time as I want. Does the file system manager make an attachment to my driver that would prevent it from reloading and if so can I remove it? I remove my attachment to the next lower driver and then call IoDeleteDevice for my device in my DriverUnload routine. Are there any other possibilities that would cause this?

Looking at device tree, it would look like this:

\device\CdRom0
– att \device\MyDriver
– fs \filesystems\udfs
---- att \filesystem\FltMgr

Also if I put in a CD and the filesystem attaches before I load my driver, it all works as expected. If I then open the CD drive and close causing a cd to load then it has this same load-unload-fail problem.

Thanks in advance for any assistance.

2

Why don’t you make your driver an upper filter for CD class? Then it will load and unload together with cdrom.sys, without you having to do anything.

3

I wanted the ability to start and stop it so that a reboot is not required when the driver gets updated. Another reason was it reads the policy mask at driver startup and thats how the existing filter drivers we have for say usb work so I wanted to keep the same functionality. I could always update the policy through device control but that does not really fix the issue of updating the driver version without a reboot unless the upper filter driver can be stopped without this current issue.

4

Just verified that it has the same problem as an upper filter unless this was incorrect…

In my INF AddRegistry, I set:

HKR,“UpperFilters”,0x00010000,“pscdfilter” ; REG_MULTI_SZ value

and use the CDROM class.

Signature = “$Windows NT$”
Class = “CDROM” ;This is determined by the work this filter driver does
ClassGuid = {4D36E965-E325-11CE-BFC1-08002BE10318} ;This value is determined by the Class
DriverPackageType = KernelService

5

You should NOT try to stop the service explicitly. The upper filter driver will unload when you disable your CDROM.

6

So i have stripped down my code to just pass all Irps and register for PnP device arrivals. It does then attach with IoAttachDeviceToDeviceStackSafe. I still have the same problem with this scaled down driver. I did test it on a USB cd rom and it has the same problem but if I unplug the device and then plug it back in, my driver will then load again and the CdRom# increments.

Is there a way to force all devices holding a reference to my driver to release them or does this sound like it might be a different problem?

Thanks!

7

If this is the case, is there no way to update the driver with a new version without a machine reboot?

8

You have a legacy driver interacting with a pnp stack. They way you get the references to be removed is to be a pnp driver and participate in pnp. That means adding yourself to the stack during pnp start (not attaching the way you are now) and using a pnp disable to unload your driver. Everything else you are doing is a hack around this truth, if it worked in the past you were getting lucky, it was not a solid design from day 1

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@projekt6.com
Sent: Friday, September 7, 2012 1:49 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Legacy Driver Unload problems.

So i have stripped down my code to just pass all Irps and register for PnP device arrivals. It does then attach with IoAttachDeviceToDeviceStackSafe. I still have the same problem with this scaled down driver. I did test it on a USB cd rom and it has the same problem but if I unplug the device and then plug it back in, my driver will then load again and the CdRom# increments.

Is there a way to force all devices holding a reference to my driver to release them or does this sound like it might be a different problem?

Thanks!

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

Make your service System start type (1). Register it as upper filter for CDROM class or device instance. If it’s a class filter, you’ll need to disable all CDROM instances before it’s unloaded. Enable verbose output in the debugger, it will show you when the driver unloads.

10

I was able to get interaction to PnP for the most part. The initial problem I had with service start type 1 and having an AddDevice routine was it never attached to anything. I then converted it to a legacy driver and still have most of the PnP code in there.

My question then is do I need to register my driver from driver entry to get it to attach or should the AddDevice routine work? I take it to register correctly all I need to do is have the AddDevice, remove my current notification register and then change my .inf to:
[pscdfilter.AddRegistry]
HKLM, System\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}, UpperFilters, 0x00010008, pscdfilter

I was afraid this was going to be the only solution but it didn’t work for me before. Does this seem right though? Thanks!

11

You need to make your driver fully PNP compliant, there is no other way around that.

12

Ok I went back to what I had initially as a PnP driver and it does not load. If I try to manually start it, I get error 1058 The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

in my inf i have what I assume are the main points as:

[Version]
Signature = “$Windows NT$”
Class = “CDROM” ;This is determined by the work this filter driver does
ClassGuid = {4D36E965-E325-11CE-BFC1-08002BE10318} ;This value is determined by the Class
Provider = %psi%
DriverVer = 08/15/2012,1.0.0.0
DriverPackageType = KernelService

DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%%DriverName%.sys
ServiceType = 1
StartType = 1
ErrorControl = 1
LoadOrderGroup = “PnP Filter”

[pscdfilter.AddRegistry]
HKLM, System\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}, UpperFilters, 0x00010008, pscdfilter

I did go back and put in my AddDevice routine
DriverObject->DriverExtension->AddDevice = FilterAddDevice;

Anything obvious that I am doing wrong?

Thanks!

13

xxxxx@projekt6.com wrote:

Ok I went back to what I had initially as a PnP driver and it does not load. If I try to manually start it, I get error 1058 The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Right, because it doesn’t. You don’t “manually start” a PnP filter
driver. The filter automatically loads when the parent driver starts.
So, after adding your filter to the registry, you need to either reboot,
or manually restart the device you want to filter.

in my inf i have what I assume are the main points as:

DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%%DriverName%.sys
ServiceType = 1
StartType = 1
ErrorControl = 1
LoadOrderGroup = “PnP Filter”

StartType should be 3 (SERVICE_DEMAND_START) for all PnP drivers.
LoadOrderGroup is irrelevant and can be removed.

[pscdfilter.AddRegistry]
HKLM, System\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}, UpperFilters, 0x00010008, pscdfilter

I did go back and put in my AddDevice routine
DriverObject->DriverExtension->AddDevice = FilterAddDevice;

That’s critical. And you’re doing your IoCreateDevice in
FilterAddDevice, right?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

14

INFs are not good at adding class filters. Also, you cannot net start/stop a pnp driver, you must restart the device stack to get the driver to load. I would recommend installing the service by hand or with sc.exe, hand edit the upperfilters and then use device manager to stop/restart the cdrom

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@projekt6.com
Sent: Friday, September 07, 2012 3:26 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Legacy Driver Unload problems.

Ok I went back to what I had initially as a PnP driver and it does not load. If I try to manually start it, I get error 1058 The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

in my inf i have what I assume are the main points as:

[Version]
Signature = “$Windows NT$”
Class = “CDROM” ;This is determined by the work this filter driver does
ClassGuid = {4D36E965-E325-11CE-BFC1-08002BE10318} ;This value is determined by the Class
Provider = %psi%
DriverVer = 08/15/2012,1.0.0.0
DriverPackageType = KernelService

DisplayName = %ServiceName%
Description = %ServiceDescription%
ServiceBinary = %12%%DriverName%.sys
ServiceType = 1
StartType = 1
ErrorControl = 1
LoadOrderGroup = “PnP Filter”

[pscdfilter.AddRegistry]
HKLM, System\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}, UpperFilters, 0x00010008, pscdfilter

I did go back and put in my AddDevice routine
DriverObject->DriverExtension->AddDevice = FilterAddDevice;

Anything obvious that I am doing wrong?

Thanks!

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

15

I assumed that it would let me start it but thought it would be worth a shot. I did delete the old service with sc.exe and then used the new inf to install it. After that I rebooted the machine but the driver did not load. I will have to try installing it manually and seeing if it loads then.

Ill report back if I have more problems. Thanks!

16

Ok so I spent a little more time trying to diagnose what is going on here. With the service type and system(1) or demand(3) my driver will load and unload as it should and work normally except for the very first time the CD is created at or after boot. Its wierd. After a reboot, if I disable the CdRom and then enable it, my driver loads and works as expected. If I disable the CdRom and then reboot, it starts out disabled as it should. The first time I enable it I see my DriverEntry and then DriverUnload without any AddDevice call. From then on it works normal until next reboot when it does the same thing. This is why I didn’t catch it loading with the inf file. Both Manual install and inf install yield the same results.

Make any sense to you guys? Oh I also read in MS docs that a PnP driver should have start type as demand but Alex suggested to use system. Is one way going to be better than the other? Thanks!

17

I may have ot it working but still have a question. In my AddDevice routine I was checking PDO->DeviceType to see if it was a CdRom device. On the first load this was preventing it from going further and it returned DeviceType as 0x2D. Any idea why this is the case and what that device type is? Without checking device type, my driver attaches and it is attached to the CdRom.

Thanks for all the help!

18

The pdo doesn’t have this type because the bus driver does not set that type of policy. The fdo is responsible for that. Dont check the type . If you are properly configured, you will always be in the right stack.

d

debt from my phone

From: xxxxx@projekt6.com
Sent: 9/10/2012 1:52 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Legacy Driver Unload problems.

I may have ot it working but still have a question. In my AddDevice routine I was checking PDO->DeviceType to see if it was a CdRom device. On the first load this was preventing it from going further and it returned DeviceType as 0x2D. Any idea why this is the case and what that device type is? Without checking device type, my driver attaches and it is attached to the CdRom.

Thanks for all the help!

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

19

Ok now it makes sense, Thanks.

I had the test in there for no real reason anymore but at one point it attached to a different device type but it was early in the development stages. I have commented that piece out and will leave it as so or remove it.

Also to answer Tim about my IoCreateDevice, it is in FilterAddDevice. Also I make a call to create my Control device here and keep a instance count of all devices created for attachment so that I can delete my Control device after all my attached devices are removed.

20

So i guess I am still having problems getting the PnP driver to load at boot.

This time I am trying it on Vista and its doing the same as my XP was before. I installed it manually the same way I last did on XP and my XP tends to start everytime now. The Vista wont. It does prevent the CdRoms from showing up to but if I disable them in device manager and then enable them, everything loads.

Any ideas?
Thanks!