Windows 7 Backup and Restore

I have a filter driver attached to ntfs on a Windows 7 32 bits. The driver stack for the \Ntfs device is :

Fltmgr (stack size 15)
MyDriver (stack size 14)
FltMgr (stack size 13)
Ntfs (stack size 13)

When I run the Backup and Restore program of Windows 7, I intercept a mount request on “\Device\HarddiskVolumeShadowCopy1”.

When I look at the StackCount of the IRP, it is set to 13 ! Shouldn’t it be 15 ?

On 3/31/2010 6:54 AM, xxxxx@gmail.com wrote:

I have a filter driver attached to ntfs on a Windows 7 32 bits. The driver stack for the \Ntfs device is :

Fltmgr (stack size 15)
MyDriver (stack size 14)
FltMgr (stack size 13)
Ntfs (stack size 13)

When I run the Backup and Restore program of Windows 7, I intercept a mount request on “\Device\HarddiskVolumeShadowCopy1”.

When I look at the StackCount of the IRP, it is set to 13 ! Shouldn’t it be 15 ?

I would think what you are seeing is the stack count for the underlying
storage stack. At the time of the mount request, the file system stack
is not yet built so there are no device instances to add more stack counts.

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

I don’t understand what you mean. The mount request is not sent to the volume being mounted but to the \ntfs device object.

I thought the stack count of an IRP should be equal to the stack size of the device object it is sent to.

As the highest-level device object attached to the \Ntfs device object has its stack count set to 15, I thought any IRP sent to this device object should have its stack size set at least to 15.

JB

The Mount IRP is allocated and sent down by IopMountVolume. If you look at what it uses for the stack size when allocating the IRP is a little involved.

It does not simply get the StackSize of the top of the file system device stack and uses it. Instead, it gets the top of the device in the storage stack for the device being mounted plus the number of devices in the file system device stack. Then it sends the IRP down to the file system stack being trialed for the mount operation.

Are you running into a specific issue saying out of IRP stack location?

Lijun

?


From: “xxxxx@gmail.com
To: Windows File Systems Devs Interest List
Sent: Wed, March 31, 2010 12:35:45 PM
Subject: RE:[ntfsd] Windows 7 Backup and Restore

I don’t understand what you mean. The mount request is not sent to the volume being mounted but to the \ntfs device object.

I thought the stack count of an IRP should be equal to the stack size of the device object it is sent to.

As the highest-level device object attached to the \Ntfs device object has its stack count set to 15, I thought any IRP sent to this device object should have its stack size set at least to 15.

JB


NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Ok, I see. I don’t encounter any problem, it’s just that I was surprised by the stack count of the IRP being lower than my device stack size.

Thanks for your answer.

JB