Unload

NTDEV
1

Hi !

I wrote a TDI filter driver. In DriverEntry I create
a new device and attach it (IoCreateDevice,
IoAttachDeviceByPointer …) to TCP device - it works ! :slight_smile:

I have a BIG problem with unload it ! In Unload procedure I
use IoDetachDevice and IoDeleteDevice, but AFTER it,
something call dispatch rountine in my deleted device !

I found strange to behaviour system (difference with DDK)

  1. My driver is marked (by system) as DRVO_UNLOAD_INVOKED,
    but still is accessible, and dispatch rountines are called.
    In DDK is:
    “After a driver has been marked as “Unload Pending,” no additional
    drivers can attach to that driver, nor can any additional references
    be made to the driver’s device objects. The driver can complete
    outstanding IRPs, but the I/O Manager will not send any new IRPs
    to the driver. When all references to the driver and its device objects
    have been released, the I/O Manager calls the driver’s Unload routine.”

  2. In DDK is:
    “The I/O Manager also calls the Unload routine when the driver
    returns a failure status from its DriverEntry routine.”
    It’s not true !

Please help me ! How can I unload driver safely ?

Best regards,
Grzegorz Malicki

2

  1. I’ve heard of this sort of thing before, recently in fact. One thing
    that comes to mind is the possibility of deferred IRPs. Those could be
    deferred indefinitely, of course, and I have to imagine from the doc
    that you cite that they’re still being counted against your device.

  2. The DDK (on the OSR site, built on 05 September 2002) says, under
    “DriverEntry Return Values”: “Note that a driver’s Unload routine is not
    called if a driver’s DriverEntry routine returns a failure status.”

–
If replying by e-mail, please remove “nospam.” from the address.

James Antognini

3

The IO manager does not synchronize dispatch routine calls with unload for
filters. You can’t unload a filter unless you are tearing the whole stack
down. This is a drawback of the classic NT filter model. So don’t detach and
delete the device object in the unload routine. The best way is to provide a
FastIoDetachDevice call back. This callback will be called when the lower
driver’s device is deleted. You then get a chance to detach and delete your
driver. Ultimately all your device objects will be detached and deleted and
that will cause the driver object to be released.

–
Nar Ganapathy
Windows Core OS group
This posting is provided “AS IS” with no warranties, and confers no rights.

“Grzegorz Malicki” wrote in message news:xxxxx@ntdev…
>
> Hi !
>
> I wrote a TDI filter driver. In DriverEntry I create
> a new device and attach it (IoCreateDevice,
> IoAttachDeviceByPointer …) to TCP device - it works ! :slight_smile:
>
> I have a BIG problem with unload it ! In Unload procedure I
> use IoDetachDevice and IoDeleteDevice, but AFTER it,
> something call dispatch rountine in my deleted device !
>
> I found strange to behaviour system (difference with DDK)
> 1. My driver is marked (by system) as DRVO_UNLOAD_INVOKED,
> but still is accessible, and dispatch rountines are called.
> In DDK is:
> “After a driver has been marked as “Unload Pending,” no additional
> drivers can attach to that driver, nor can any additional references
> be made to the driver’s device objects. The driver can complete
> outstanding IRPs, but the I/O Manager will not send any new IRPs
> to the driver. When all references to the driver and its device objects
> have been released, the I/O Manager calls the driver’s Unload routine.”
>
> 2. In DDK is:
> “The I/O Manager also calls the Unload routine when the driver
> returns a failure status from its DriverEntry routine.”
> It’s not true !
>
> Please help me ! How can I unload driver safely ?
>
> Best regards,
> Grzegorz Malicki
>
>
>
>
>

4

> I wrote a TDI filter driver. In DriverEntry I create

a new device and attach it (IoCreateDevice,
IoAttachDeviceByPointer …) to TCP device - it works ! :slight_smile:

I have a BIG problem with unload it ! In Unload procedure I

Usually, you cannot unload filters.

Max