Unloading volume filter driver

NTDEV
1

I have a Kmdf upper volume class filter driver that works fine, except…
:slight_smile:

Under WinPE built from Server 2003 SP1, if there are no volume class device
objects to filter, my driver does not unload properly. It acts exactly like
volsnap does in this KB article:

http://support.microsoft.com/kb/910380


Cause:
This problem occurs because no device objects are associated with the
Volsnap.sys driver when Windows PE starts from a RIS server on a system that
includes raw disks. The input and output (I/O) manager tries to unload the
Volsnap.sys driver, but this action is unsuccessful because of an
outstanding reference to the driver object. When Diskpart.exe creates a
volume, the system searches the driver list but cannot find the Volsnap.sys
driver. Then, the system tries to load the Volsnap.sys driver, but this
action fails because the Volsnap.sys driver is still on the loaded modules
list.


I have worked around this issue by creating a dummy control device object in
DriverEntry. This prevents the driver from being unloaded because of a lack
of devices to filter.

My question is, how is this supposed to work? What is referencing the
driver object that prevents the driver from unloading? Is it likely
something in my driver, or is there an external reference that is causing
this?

Thanks,
- Dan.

2

More information:

Despite what the KB article says, my driver object is getting deleted, so it
is not a driver object reference problem. Nevertheless, the driver is still
on the loaded module list, so Pnp can’t reload the driver. How could this
happen?

Thanks,

  • Dan.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Dan Kyler
Sent: Tuesday, December 04, 2007 10:42 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Unloading volume filter driver

I have a Kmdf upper volume class filter driver that works fine, except…
:slight_smile:

Under WinPE built from Server 2003 SP1, if there are no volume class device
objects to filter, my driver does not unload properly. It acts exactly like
volsnap does in this KB article:

http://support.microsoft.com/kb/910380


Cause:
This problem occurs because no device objects are associated with the
Volsnap.sys driver when Windows PE starts from a RIS server on a system that
includes raw disks. The input and output (I/O) manager tries to unload the
Volsnap.sys driver, but this action is unsuccessful because of an
outstanding reference to the driver object. When Diskpart.exe creates a
volume, the system searches the driver list but cannot find the Volsnap.sys
driver. Then, the system tries to load the Volsnap.sys driver, but this
action fails because the Volsnap.sys driver is still on the loaded modules
list.


I have worked around this issue by creating a dummy control device object in
DriverEntry. This prevents the driver from being unloaded because of a lack
of devices to filter.

My question is, how is this supposed to work? What is referencing the
driver object that prevents the driver from unloading? Is it likely
something in my driver, or is there an external reference that is causing
this?

Thanks,
- Dan.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer