registering with mup

NTFSD
1

I have a driver that, till now, has provided network access by pretending
to be a disk mapped to a drive. I am trying to turn it into a UNC
provider. I have made what I believe are all the obvious changes.

I call FsRtlRegisterUncProvider() in response to a user-mode. IOCTL.
FsRtlRegisterUncProvider() returns C0000005 (STATUS_ACCESS_VIOLATION).
When I step through the routine in SoftIce that status comes back from
the NtFsFileControl() directed to the MUP informing it of my device’s
name.

Can anyone tell me what checks the MUP performs in response to being poked
by FsRtlRegisterUncProvider()? Can I assume that STATUS_ACCESS_VIOLATION
means the MUP caught a GPF (probably dereferencing a bad pointer)? Or
does it generate STATUS_ACCESS_VIOLATION on its own to indicate a failed
check that it was performing?

tia - chuck

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

I seem to recall having this problem a long time ago. If I remember
correctly the solution was making sure everything is initialized and
clearing the DO_DEVICE_INITIALIZING flag in the file system device
object before calling FsRtlRegisterUncProvider().

ClearFlag(FileSystemDeviceObject->Flags, DO_DEVICE_INITIALIZING);

I believe calling FsRtlRegisterUncProvider() caused IRPs to be be
queued to the file system device object.

Best regards,
Bruce Engle

-----Original Message-----
From: xxxxx@MagicSquare.com [mailto:xxxxx@MagicSquare.com]
Sent: Thursday, November 01, 2001 7:36 AM
To: File Systems Developers
Subject: [ntfsd] registering with mup

I have a driver that, till now, has provided network access by pretending
to be a disk mapped to a drive. I am trying to turn it into a UNC
provider. I have made what I believe are all the obvious changes.

I call FsRtlRegisterUncProvider() in response to a user-mode. IOCTL.
FsRtlRegisterUncProvider() returns C0000005 (STATUS_ACCESS_VIOLATION).
When I step through the routine in SoftIce that status comes back from
the NtFsFileControl() directed to the MUP informing it of my device’s
name.

Can anyone tell me what checks the MUP performs in response to being poked
by FsRtlRegisterUncProvider()? Can I assume that STATUS_ACCESS_VIOLATION
means the MUP caught a GPF (probably dereferencing a bad pointer)? Or
does it generate STATUS_ACCESS_VIOLATION on its own to indicate a failed
check that it was performing?

tia - chuck

You are currently subscribed to ntfsd as: xxxxx@SERENA.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

***********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. Any unauthorized review, use, disclosure or distribution
is prohibited. If you are not the intended recipient, please contact
the sender by reply e-mail and destroy all copies of the original
message.
***********************************************************************

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

> I call FsRtlRegisterUncProvider() in response to a user-mode. IOCTL.

FsRtlRegisterUncProvider() returns C0000005 (STATUS_ACCESS_VIOLATION).

The solution is in the comment in my code a year ago.

// NOTE: FsRtlRegisterUncProvider cannot be called with ExGetPreviousMode() == UserMode
// (bug in NT4?)
// The reason is that FsRtlpRegisterProviderWithMUP will call MUP with NtFsControlFile
// which will in turn probe the supplied kernel space pointers against
// ExGetPreviousMode() == UserMode and will fail the request with STATUS_ACCESS_VIOLATION.
// Our logic require us to call this from IOCTL_xxx_xxx_STARTUP path called by the user mode
// service with (surely) ExGetPreviousMode() == UserMode.
// So, the need for the routines below which call FsRtlRegisterUncProvider from the work item
// function (the system thread).

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com