RtlVolumeDeviceToDosName() doesn't return

Hi all,

Still hoping somebody might have some futher suggestions on the following
problem. I’m not really sure what else to try at this stage.

I have a filter driver which hooks volumes on mount to monitor file access
activity. In my handler for the first CREATE IRP directed at the mounted
volume I call RtlVolumeDeviceToDosName() (or IoVolumeDeviceToDosName(), it
doesn’t matter) to obtain the drive letter of the volume, passing in the
DEVICE_OBJECT which I got in the mount completion routine.

This works perfectly in most cases. However, in the case of volumes which
reside on a USB 2.0-connected hard disk, RtlVolumeDeviceToDosName() never
returns. If I understand correctly, the mount is guaranteed to have
completed by the time of the first CREATE IRP, so I’m confused about what
the system might be waiting for.

Any suggestions on what to try next would be greatly appreciated.

Thanks and regards,

Richard Cartwright
Spherical Technology Pty Ltd
www.sphericaltech.com

Richard,

you may schedule IRP_MN_MOUNT_VOLUME events to your user-mode service and
make the conversion there. Just give back the result synchronously.

“Richard Cartwright” schrieb im Newsbeitrag
news:xxxxx@ntfsd…
> Hi all,
>
> Still hoping somebody might have some futher suggestions on the following
> problem. I’m not really sure what else to try at this stage.
>
> I have a filter driver which hooks volumes on mount to monitor file access
> activity. In my handler for the first CREATE IRP directed at the mounted
> volume I call RtlVolumeDeviceToDosName() (or IoVolumeDeviceToDosName(), it
> doesn’t matter) to obtain the drive letter of the volume, passing in the
> DEVICE_OBJECT which I got in the mount completion routine.
>
> This works perfectly in most cases. However, in the case of volumes which
> reside on a USB 2.0-connected hard disk, RtlVolumeDeviceToDosName() never
> returns. If I understand correctly, the mount is guaranteed to have
> completed by the time of the first CREATE IRP, so I’m confused about what
> the system might be waiting for.
>
> Any suggestions on what to try next would be greatly appreciated.
>
> Thanks and regards,
>
> Richard Cartwright
> Spherical Technology Pty Ltd
> www.sphericaltech.com
>
>

> I have a filter driver which hooks volumes on mount to monitor file access

activity. In my handler for the first CREATE IRP directed at the mounted
volume I call RtlVolumeDeviceToDosName() (or IoVolumeDeviceToDosName
(), it
doesn’t matter) to obtain the drive letter of the volume, passing in the

I would redesign this system to use mountdev IDs of the volume. Yes, even not
GUIDs, but mountdev IDs, which are BLOBs of any size (usually short, for
usual non-software-RAID partition on any disk - 12bytes).

You can convert across drive letters and mountdev IDs in the control IOCTL path
of your driver.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

If you call RtlVolumeDeviceToDosName() in the completion routine, then
insert ASSERT( KeGetCurrentIrql() == PASSIVE_LEVEL ) before calling
RtlVolumeDeviceToDosName().

“Richard Cartwright” wrote in message
news:xxxxx@ntfsd…
> Hi all,
>
> Still hoping somebody might have some futher suggestions on the following
> problem. I’m not really sure what else to try at this stage.
>
> I have a filter driver which hooks volumes on mount to monitor file access
> activity. In my handler for the first CREATE IRP directed at the mounted
> volume I call RtlVolumeDeviceToDosName() (or IoVolumeDeviceToDosName(), it
> doesn’t matter) to obtain the drive letter of the volume, passing in the
> DEVICE_OBJECT which I got in the mount completion routine.
>
> This works perfectly in most cases. However, in the case of volumes which
> reside on a USB 2.0-connected hard disk, RtlVolumeDeviceToDosName() never
> returns. If I understand correctly, the mount is guaranteed to have
> completed by the time of the first CREATE IRP, so I’m confused about what
> the system might be waiting for.
>
> Any suggestions on what to try next would be greatly appreciated.
>
> Thanks and regards,
>
> Richard Cartwright
> Spherical Technology Pty Ltd
> www.sphericaltech.com
>
>

Hi Slava,

If you call RtlVolumeDeviceToDosName() in the completion routine, then
insert ASSERT( KeGetCurrentIrql() == PASSIVE_LEVEL ) before calling
RtlVolumeDeviceToDosName().

Thanks, I already tried this one with the same effect. Then I saw a post
from Neal Christiansen saying that its not safe to do it in the completion
routine at all. I’m therefore currently doing it in the first create on the
volume.

I’ve found a bunch of comments yesterday in SFilter explaining that
basically the only safe way to call RtlVolumeDeviceToDosName() is from a
worker, since mount manager can always be on the stack below my driver
holding a lock. I’m therefore going to move over to this method and see how
I go.

Thanks for your help,
Richard