Hi Guys,
i have a legacy file filter driver.during completion of IRP_MN_MOUNT_VOLUME irp, i attach my filter driver to volume and i open that volume using ZwOpenFile or ZwCreateFile to check is it NTFS volume or not?
but when i debug my driver and execute ZwopenFile or ZwCreateFile debugger never comes out. i mean to say that control never comes out from ZwOpenFile or ZwCreateFile.
please throw some lights…
Thank You
Which OS is this ?
There are various locks taken during a MOUNT and you might run into a
deadlock. Some of them have been removed in newer OS versions and so please
try in Win7 and see if it still happens.
For example, see the documentation for FltGetVolumeGuidName:
" FltGetVolumeGuidName cannot safely be called from a pre-mount or
post-mount callback. It cannot safely be called because even when the
post-mount callback is called, the mount processing has not been completed
by the I/O manager, and this causes a deadlock with the mount manager in
certain cases.
On Windows Vista and later, a minifilter driver can safely call
FltGetVolumeGuidName from its InstanceSetupCallback routine
(PFLT_INSTANCE_SETUP_CALLBACK) because the callback is called on the first
I/O operation for a new volume after all of the mount processing is
completed.
On Windows operating systems earlier than Windows Vista,
FltGetVolumeGuidName cannot safely be called from an InstanceSetupCallback
routine because the mount manager might issue a file I/O operation while
holding a lock, which can cause a deadlock. "
Thanks,
Alex.
os is winxp and i have a legacy file filter driver…
Can you afford to wait for the first operation on the volume and check
inline there instead of in the MOUNT operation ? Or maybe queue a workitem ?
Thanks,
Alex.