Minifilter behaving oddly

NTFSD
1

When I try to unload my minifilter I am not getting a call to NvInstanceContextCleanup() nor am I getting a call to NvCtxInstanceQueryTeardown (). Any ideas as to why this might be?

testing on XP home with sp2

Larry

CONST FLT_REGISTRATION FilterRegistration = {

sizeof(FLT_REGISTRATION), // Size

FLT_REGISTRATION_VERSION, // Version

0, // Flags

NvContextRegistration, // Context

Callbacks, // Operation callbacks

NvFsFilterUnload, // FilterUnload

NvCtxInstanceSetup, // InstanceSetup

NvCtxInstanceQueryTeardown , // InstanceQueryTeardown

NvCtxInstanceTeardownStart, // InstanceTeardownStart

NvCtxInstanceTeardownComplete, // InstanceTeardownComplete

NULL, // GenerateFileName

NULL, // GenerateDestinationFileName

NULL // NormalizeNameComponent

#if NVFSMON_LONGHORN

,

SpyKtmNotificationCallback // KTM notification callback

#endif // NVFSMON_LONGHORN

};

FLT_CONTEXT_REGISTRATION NvContextRegistration =

{{FLT_INSTANCE_CONTEXT, 0, NvInstanceContextCleanup, sizeof(NvInstanceContext), NVCTX_TAG},

{FLT_CONTEXT_END}

}

;

2

The instance comtext clean will not happen until the references on the
instance context go away.

Does evrything work OK when you detach by hand? ISTR that whether unload
calls teardown or not can be under control of the registry.

wrote in message news:xxxxx@ntfsd…
> When I try to unload my minifilter I am not getting a call to
> NvInstanceContextCleanup() nor am I getting a call to
> NvCtxInstanceQueryTeardown (). Any ideas as to why this might be?
>
> testing on XP home with sp2
>
> Larry
>
>
>
> CONST FLT_REGISTRATION FilterRegistration = {
>
> sizeof(FLT_REGISTRATION), // Size
>
> FLT_REGISTRATION_VERSION, // Version
>
> 0, // Flags
>
> NvContextRegistration, // Context
>
> Callbacks, // Operation callbacks
>
> NvFsFilterUnload, // FilterUnload
>
> NvCtxInstanceSetup, // InstanceSetup
>
> NvCtxInstanceQueryTeardown , // InstanceQueryTeardown
>
> NvCtxInstanceTeardownStart, // InstanceTeardownStart
>
> NvCtxInstanceTeardownComplete, // InstanceTeardownComplete
>
> NULL, // GenerateFileName
>
> NULL, // GenerateDestinationFileName
>
> NULL // NormalizeNameComponent
>
> #if NVFSMON_LONGHORN
>
> ,
>
> SpyKtmNotificationCallback // KTM notification callback
>
> #endif // NVFSMON_LONGHORN
>
> };
>
>
>
> FLT_CONTEXT_REGISTRATION NvContextRegistration =
>
> {{FLT_INSTANCE_CONTEXT, 0, NvInstanceContextCleanup,
> sizeof(NvInstanceContext), NVCTX_TAG},
>
> {FLT_CONTEXT_END}
>
> }
>
> ;
>
>

3

If you have not properly released your context allocations, this driver
will not unload. If it does indeed unload, this probably means all context
have already been freed and this is why your not seeing your
contextcleanup being called - there might not be anything to cleanup…

Regarding your QueryTeardown - this callback is never invoked for
mandatory or automatic unloads. Set a breakpoint and unload with
fltmc unload instead of sc commands.

xxxxx@sbcglobal.net wrote:

>When I try to unload my minifilter I am not getting a call to NvInstanceContextCleanup() nor am I getting a call to NvCtxInstanceQueryTeardown (). Any ideas as to why this might be?
>
>testing on XP home with sp2
>
>Larry
>
>
>
>CONST FLT_REGISTRATION FilterRegistration = {
>
>sizeof(FLT_REGISTRATION), // Size
>
>FLT_REGISTRATION_VERSION, // Version
>
>0, // Flags
>
>NvContextRegistration, // Context
>
>Callbacks, // Operation callbacks
>
>NvFsFilterUnload, // FilterUnload
>
>NvCtxInstanceSetup, // InstanceSetup
>
>NvCtxInstanceQueryTeardown , // InstanceQueryTeardown
>
>NvCtxInstanceTeardownStart, // InstanceTeardownStart
>
>NvCtxInstanceTeardownComplete, // InstanceTeardownComplete
>
>NULL, // GenerateFileName
>
>NULL, // GenerateDestinationFileName
>
>NULL // NormalizeNameComponent
>
>#if NVFSMON_LONGHORN
>
>,
>
>SpyKtmNotificationCallback // KTM notification callback
>
>#endif // NVFSMON_LONGHORN
>
>};
>
>
>
>FLT_CONTEXT_REGISTRATION NvContextRegistration =
>
>{{FLT_INSTANCE_CONTEXT, 0, NvInstanceContextCleanup, sizeof(NvInstanceContext), NVCTX_TAG},
>
>{FLT_CONTEXT_END}
>
>}
>
>;
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>