replace (unload/load) kernel dll

NTFSD
1

I have a legacy filter driver that is implemented with a driver that is basically a stub and a set of kernel dlls (TARGET_TYPE=EXPORT_DRIVER) that do all the actual work.

When I have a new version I don’t want the user to have to reboot. I would like to be able to unload the kernel dlls, copy the new ones in and then load the new ones.

It seems like a catch-22 because, as I understand it, the kernel dlls will only unload once there are no more references to them, but I can’t unload a legacy filter driver so the reference count won’t ever go to 0.

Is this possible? Is there another way to update a filter driver without requiring a reboot?

Any help is greatly appreciated.

Thanks,

Paul Judson

2

I usually do this with a registration interface, rather than a DLL
interface. The registration can then be reversed (de-registration) and
the buddy driver can be unloaded. It does require a bit more work to do
this.

Be very cognizant of the APIs that cannot be safely used in an
unloadable driver, however, because if you use any of them (e.g.,
executive work items, kernel timers, fast I/O routines, etc.) you CANNOT
safely unload - leave those pieces in the unremovable piece.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netiq.com
Sent: Thursday, August 10, 2006 6:10 PM
To: ntfsd redirect
Subject: [ntfsd] replace (unload/load) kernel dll

I have a legacy filter driver that is implemented with a driver that is
basically a stub and a set of kernel dlls (TARGET_TYPE=EXPORT_DRIVER)
that do all the actual work.

When I have a new version I don’t want the user to have to reboot. I
would like to be able to unload the kernel dlls, copy the new ones in
and then load the new ones.

It seems like a catch-22 because, as I understand it, the kernel dlls
will only unload once there are no more references to them, but I can’t
unload a legacy filter driver so the reference count won’t ever go to 0.

Is this possible? Is there another way to update a filter driver without
requiring a reboot?

Any help is greatly appreciated.

Thanks,

Paul Judson

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Tony,

Could you point me to some documentation, white papers, examples, etc. that talk about using the registration interface?

Thanks,

Paul Judson

4

I’ve never seen someone sit down and write a description of how this is
done, although it is certainly discussed in this forum from time to
time.

We do this by having the second (unloadable) driver call the first
(non-unloadble) driver via an IOCTL. The IOCTL passes along the
“registration information” (usually a structure with versioning
information and a set of function pointers.)

Another way to do this is to have the non-unloadable driver be the DLL
and have the registration (and deregistration) entry point(s) be
exported from the non-unloadable driver. Then the unloadable driver can
just call a function that is exported by the non-unloadable driver.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netiq.com
Sent: Friday, August 11, 2006 8:42 AM
To: ntfsd redirect
Subject: RE:[ntfsd] replace (unload/load) kernel dll

Tony,

Could you point me to some documentation, white papers, examples, etc.
that talk about using the registration interface?

Thanks,

Paul Judson

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

PAUL:

I’ve also done this. You have to roll your own; there is no official
way; actually, the official way is not to do something like this.

MM

>> xxxxx@osr.com 2006-08-11 10:12:41 >>>
I’ve never seen someone sit down and write a description of how this
is
done, although it is certainly discussed in this forum from time to
time.

We do this by having the second (unloadable) driver call the first
(non-unloadble) driver via an IOCTL. The IOCTL passes along the
“registration information” (usually a structure with versioning
information and a set of function pointers.)

Another way to do this is to have the non-unloadable driver be the DLL
and have the registration (and deregistration) entry point(s) be
exported from the non-unloadable driver. Then the unloadable driver
can
just call a function that is exported by the non-unloadable driver.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netiq.com
Sent: Friday, August 11, 2006 8:42 AM
To: ntfsd redirect
Subject: RE:[ntfsd] replace (unload/load) kernel dll

Tony,

Could you point me to some documentation, white papers, examples, etc.
that talk about using the registration interface?

Thanks,

Paul Judson

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com