Question on how/when drivers are loaded

NTDEV
1

Ok, I have my KMDF driver working fine. Turns out (ha, ha) the customer forgot to tell me that there might be multiple instances of this device! Ok, fine, no problem, I’ll use instance data and stuff the device-specific stuff in there… BUT…

…I’m seeing DriverEntry() called multiple times. This is puzzling as I’m only asking to be loaded for one specific device. I expect it’s an error in my INF file, but it does bring up the question: under what circumstances will Windows load a new instance of my driver, instead of simply calling DeviceAdd()? I’m puzzled as to what’s going on under the hood…

All info, links, etc. greatly appreciated!

…ed…

2

xxxxx@woolyloach.com wrote:

…I’m seeing DriverEntry() called multiple times. This is puzzling as I’m only asking to be loaded for one specific device. I expect it’s an error in my INF file, but it does bring up the question: under what circumstances will Windows load a new instance of my driver, instead of simply calling DeviceAdd()? I’m puzzled as to what’s going on under the hood…

The only time you should see a new DriverEntry is if you get unloaded.
If you unplug a USB device and then replug, the driver is unloaded, and
then reloaded, which means a new DriverEntry call.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Ok, something bogus is obviously happening. I use drvload to wedge my driver in and DbgView is showing my DriverEntry() debug output twice, which is what was puzzling me. I suppose it’s possible something in the system is re-enumerating and I’m getting tossed out and reloaded… I’ll have to look into that and see if that’s what’s going on.

Thanks for the super-fast response!

…ed…

4

>>I’m seeing DriverEntry() called multiple times. This is puzzling as I’m only asking to be loaded for one specific device.

I believe you are seeing this because you are triggering device installation on the subsequent devices. If you update an existing driver binary (and nobody is tasked with somehow “remembering” that the driver package you already have installed on the machine is actually the same package as the one you are now installing), the devices using it are disabled (if possible- if not possible you are told a reboot is needed), the driver files are updated with whatever driver package matched in the driver store (and this is why you can’t just overwrite a driver file and expect it to stick around, btw), and then all of the devices are re-enabled, and the new one is added and started, as well.

5

Bob, that seems very likely. I’m digging in deeper now to see what’s going on…

DbgPrint() is my friend…

…ed…

6

You can also use the ETW output from KMDF and do a user mode logging session with it, also- there are tools in the WDK (and the appropriate tmf file so the output can be properly formatted is there as well) for this, and it would show the unloads and loads and starts and all the rest of it. You wouldn’t have to change your driver source code to do this, either.

Unfortunately, I don’t know if or where or how well this is documented. I know it’s been discussed /mentioned on NTDEV, but what I remember of it was a few years back.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@woolyloach.com
Sent: Monday, October 25, 2010 3:03 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Question on how/when drivers are loaded

Bob, that seems very likely. I’m digging in deeper now to see what’s going on…

DbgPrint() is my friend…

…ed…

7

If the issue remains intractable I’ll pursue that, Bob! Thanks for the pointer!

…ed…

8

You can also get multiple driver entries calls if you munge the inf file to
the point that the IO manager thinks it needs to load your driver again.
It’s been a number of years since I caused that faux pax, so I do not
remember the specifics, but it can happen.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Monday, October 25, 2010 4:34 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Question on how/when drivers are loaded

xxxxx@woolyloach.com wrote:

…I’m seeing DriverEntry() called multiple times. This is puzzling as I’m
only asking to be loaded for one specific device. I expect it’s an error in
my INF file, but it does bring up the question: under what circumstances
will Windows load a new instance of my driver, instead of simply calling
DeviceAdd()? I’m puzzled as to what’s going on under the hood…

The only time you should see a new DriverEntry is if you get unloaded.
If you unplug a USB device and then replug, the driver is unloaded, and then
reloaded, which means a new DriverEntry call.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 5562 (20101025) __________

The message was checked by ESET Smart Security.

http://www.eset.com