We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byJadon Privott
Modified over 2 years ago
Loading and Unloading Minifilters© 2004 Microsoft Corporation. All rights reserved.
Features A minifilter may be loaded at any timeA minifilters “altitude” defines its location in the attachment stack Filters have control over what volumes they attach to Filters may support multiple instances (more then one attachment to a given volume) Filters automatically notified about existing volumes © 2004 Microsoft Corporation. All rights reserved.
Features A minifilter may be unloaded at any timeFilters have control over when they unload If reloaded, will be inserted back in the same frame © 2004 Microsoft Corporation. All rights reserved.
Triggering Minifilter LoadDriver start type of BOOT, SYSTEM or AUTO when the system boots Must use existing load order group definitions for minifilters This is necessary to support proper interoperation with legacy filters Service Start request via: “sc start” or “net start” commands service APIs An explicit load request via: “fltmc load” command FltLoadFilter() API (Kernel mode) FilterLoad() API (User mode) © 2004 Microsoft Corporation. All rights reserved.
Load Order Groups FSFilter Activity Monitor FSFilter UndeleteFSFilter Anti-Virus FSFilter Replication FSFilter Continuous Backup FSFilter Content Screener FSFilter Quota Management FSFilter System Recovery FSFilter Cluster File System FSFilter HSM FSFilter Compression FSFilter Encryption FSFilter Physical Quota Management FSFilter Open File FSFilter Security Enhancer FSFilter Copy Protection © 2004 Microsoft Corporation. All rights reserved.
Minifilter Startup DriverEntry() routine called when driver is loadedDo global initialization Call FltRegisterFilter() API Registers callbacks with Filter Manager Call FltStartFiltering() API Volume enumeration may start before this call returns © 2004 Microsoft Corporation. All rights reserved.
Triggering Instance CreationAt minifilter FltStartFiltering() time Existing volumes enumerated Volume mount An explicit attachment request via: “fltmc attach” command FltAttachVolume() API (kernel mode) FilterAttach() API (user mode) © 2004 Microsoft Corporation. All rights reserved.
What controls which instances are createdInstance definitions in INF file Defines: instance name, altitude, flags Altitude values are defined and maintained by Microsoft Flags contains OR-able bit values: 0x01 = when set suppress automatic attachment 0x02 = when set suppress manual attachment Defines: DefaultInstance Must be specified, used to order filters so mount and instance setup callbacks are sent in the correct order Also used with FltAttachVolume()/ FilterAttach() APIs when no instance name is specified © 2004 Microsoft Corporation. All rights reserved.
What controls which instances are created (cont)Instance definitions in INF file (cont) Multiple instances may be defined Definitions apply across all volumes Currently uses AddRegistry section A new “Instance” section type will be added to INF files InstanceSetup() callback in FLT_REGISTRATION structure © 2004 Microsoft Corporation. All rights reserved.
Sample Instance DefinitionsFrom MiniSpy.inf: [Minispy.AddRegistry] HKR,"Instances","DefaultInstance",0x ,"Minispy - Top Instance" HKR,"Instances\Minispy - Bottom Instance","Altitude",0x ,“365000" HKR,"Instances\Minispy - Bottom Instance","Flags",0x ,0x1 HKR,"Instances\Minispy - Middle Instance","Altitude",0x ,“370000" HKR,"Instances\Minispy - Middle Instance","Flags",0x ,0x1 HKR,"Instances\Minispy - Top Instance","Altitude",0x ,“385000" HKR,"Instances\Minispy - Top Instance","Flags",0x ,0x1 © 2004 Microsoft Corporation. All rights reserved.
InstanceSetup callbackIf NULL, the instance is always created If defined: FLT_INSTANCE_SETUP_FLAGS parameter identifies why this instance is being created Automatic Manual Newly mounted volume VolumeDeviceType parameter identifies the device type for this volume FILE_DEVICE_DISK_FILE_SYSTEM FILE_DEVICE_NETWORK_FILE_SYSTEM FILE_DEVICE_CD_ROM_FILE_SYSTEM © 2004 Microsoft Corporation. All rights reserved.
InstanceSetup callback (cont)VolumeFilesystemType parameter identifies the file system type for this volume FLT_FSTYPE_NTFS FLT_FSTYPE_FAT FLT_FSTYPE_LANMAN Etc Instance creation may be failed by returning an error or warning NTSTATUS © 2004 Microsoft Corporation. All rights reserved.
Triggering Minifilter UnloadService stop request via: “sc stop” or “net stop” commands Service APIs An explicit unload request via: “fltmc unload” command FltUnloadFilter() API (kernel mode) FilterUnload() API (user mode) © 2004 Microsoft Corporation. All rights reserved.
Controlling Minifilter UnloadTwo mechanisms through FLT_REGISTRATION structure FilterUnload() callback FLTFL_REGISTRATION_DO_NOT_ SUPPORT_SERVICE_STOP flag FltMgr sets DriverUnload() routine in filter It calls, at the appropriate time, any DriverUnload() routine the minifilter may have set in its DriverObject © 2004 Microsoft Corporation. All rights reserved.
FilterUnload callbackIf NULL, the minifilter cannot be unloaded If defined: Mandatory unloads (via service stop) cannot be failed Non-mandatory unloads (via FltUnloadFilter() or FilterUnload() APIs) may be failed by returning an error or warning NTSTATUS FLT_FILTER_UNLOAD_FLAGS parameter identifies reason for unload © 2004 Microsoft Corporation. All rights reserved.
FLTFL_REGISTRATION_DO_ NOT_SUPPORT_SERVICE_STOP flagIf set, a minifilter can not be unloaded via a service stop request If a FilterUnload() callback is defined, the minifilter may be unloaded via the FltUnloadFilter() or FilterUnload() APIs Use this flag if you always need to have the option of failing an unload request © 2004 Microsoft Corporation. All rights reserved.
Minifilter’s Responsibilities in FilterUnload callbackCall FltUnregisterFilter(), Filter Manager then: Deletes all instances Deletes volume contexts Waits for outstanding Filter references Entries pending in generic work queue FltObjectReference()/FltObjectDereference() When this returns all instances have been deleted Do global cleanup: Delete global EResources Free global memory and delete lookaside lists Unregister global callbacks Timer, Process or Thread notification callbacks Minifilter will be unloaded if a success NTSTATUS is returned © 2004 Microsoft Corporation. All rights reserved.
Triggering Instance teardownA minifilter being unloaded A volume being dismounted An explicit detach request via “fltmc detach” command FltDetachVolume() API (kernel mode) FilterDetach() API (user mode) © 2004 Microsoft Corporation. All rights reserved.
Controlling Instance TeardownIn FLT_REGISTRATION structure: InstanceQueryTeardown() callback InstanceTeardownStart() callback InstanceTeardownComplete() callback © 2004 Microsoft Corporation. All rights reserved.
InstanceQueryTeardown CallbackOnly called for explicit detach requests via FltDetachVolume() or FilterDetach() Not called for FilterUnload() Not called for volume dismount If NULL, instance cannot be torn down via an explicit detach request If defined: May be failed by returning an error or warning NTSTATUS If a success NTSTATUS is returned, teardown starts immediately © 2004 Microsoft Corporation. All rights reserved.
InstanceTeardownStart CallbackMay be NULL, instance is still torndown If defined: Must: Pass on or complete pended preOperation IOs Use FltCompletePendedPreOperation() Guarantee you won’t pend any new IOs (see FltCbdqXxx() routines) Complete pended postOperation IOs Use FltCompletePendedPostOperation() May: Close opened files Make worker threads start doing minimal work Cancel filter initiated IOs Stop queuing new work items No new operation callbacks are being sent to the minifilter, may see operation callbacks for operations started before teardown was initiated © 2004 Microsoft Corporation. All rights reserved.
Outstanding Operation CallbacksAny currently executing preOperation callback continues normal processing Any currently executing postOperation callback continues normal processing Any IO that has completed the preOperation callback and is waiting for a postOperation callback may be “drained” or “canceled” © 2004 Microsoft Corporation. All rights reserved.
“Draining” Operation CallbacksIs a PostOperation callback that is called asynchronously from the actual operation being completed. Always called at a safe IRQL FLTFL_POST_OPERATION_DRAINING in “Flags” parameter is set Receives “fake” CallbackData structure Minimally initialized Contains valid FLT_IO_PARAMETER_BLOCK (Iopb) IoStatus.Status contains STATUS_FLT_POST_OPERATION_CLEANUP Receives fully populated FLT_RELATED_OBJECTS structure Must: Perform minimal work Cleanup context from preOperation callback Return FLT_POSTOP_FINISHED_PROCESSING Must Not: Restore swapped data buffers Attempt to defer the operation in any way If drained, will not receive a normal postOperation callback © 2004 Microsoft Corporation. All rights reserved.
“Cancelling” Operation CallbacksIf buffers have been swapped for a given operation, that operation is not drainable Instead, Filter Manager attempts to cancel the operation After canceling, Filter Manager waits for the operation to complete © 2004 Microsoft Corporation. All rights reserved.
Minifilter Generated IOsThese IOs will continue normal processing Minifilter should cancel any long lived IOs Oplocks, directory change notifications, etc. Instance teardown will wait for all filter generated IOs to complete © 2004 Microsoft Corporation. All rights reserved.
InstanceTeardownComplete callbackMay be NULL, instance is still torndown If defined: When called, all outstanding IO operations have been completed or drained WARNING: This routine will not be called if: There are any outstanding pended operations There is any outstanding filter generated IO The unload request will look like it has hung Must Close any files that are still open Referencing an Instance (with FltObjectReference) does not prevent this routine from being called © 2004 Microsoft Corporation. All rights reserved.
Final Cleanup of InstanceWaits for outstanding Instance references Waits for deferred IO work items to complete Waits for any other references on the instance FltObjectReference()/FltObjectDereference() All remaining contexts deleted The instance is now gone © 2004 Microsoft Corporation. All rights reserved.
Debugging Aids In checked builds:Lots of internal asserts When your minifilter unloads, the following is reported on the debugger screen: Contexts you have forgotten to release Files opened by FltCreateFile() that you have forgotten to close Try !fltkd.help in debugger for Filter Manager debugger extensions © 2004 Microsoft Corporation. All rights reserved.
© 2004 Microsoft Corporation. All rights reserved. 1 Processing IO Operations.
© 2004 Microsoft Corporation. All rights reserved. 1 Minifilter Generated IO’s.
Filter Manager Rajeev Nagar Lead Program Manager Core File Services
© 2004 Microsoft Corporation. All rights reserved. 1 Rules for Filters (both Legacy and Mini)
© 2004 Microsoft Corporation. All rights reserved. 1 Modifying Parameters.
© Microsoft Corporation1 Windows Kernel Internals I/O Architecture *David B. Probert, Ph.D. Windows Kernel Development Microsoft Corporation.
Filter Manager Overview
© 2004 Microsoft Corporation. All rights reserved. 1 File Name Management.
© 2004 Microsoft Corporation. All rights reserved. 1 Context Management.
Developing WIA Drivers Byron Changuion Developer Windows Imaging Group Microsoft Corporation.
4P13 Week 12 Talking Points Device Drivers 1.Auto-configuration and initialization routines 2.Routines for servicing I/O requests (the top half)
4P13 Week 9 Talking Points
WHDC PowerPoint Template Notes & Handouts
WDM 드라이버의 기본 구조 What is WDM?
Backup and Recovery Part 1.
CE Operating Systems Lecture 2 Low level hardware support for operating systems.
Windows Vista Inside Out Chapter 22 - Monitoring System Activities with Event Viewer Last modified am.
NT Kernel CS Spring Overview Interrupts and Exceptions: Trap Handler Interrupt Request Levels and IRT DPC’s, and APC’s System Service Dispatching.
© 2004 Microsoft Corporation. All rights reserved. 1 Accessing User Buffers.
CS 450 Module R4. R4 Overview Due on March 11 th along with R3. R4 is a small yet critical part of the MPX system. In this module, you will add the functionality.
File System and File System Filter Ecosystem Update Neal Christiansen Development Lead File System Filter Team.
Oracle Data Integrator Procedures, Advanced Workflows.
I/O Request Flaw in WDF Kernel-Mode Driver
Case Study: Windows 2000 Part I Will Richards CPSC 550 Spring 2001.
Recall: Three I/O Methods Synchronous: Wait for I/O operation to complete. Asynchronous: Post I/O request and switch to other work. DMA (Direct Memory.
FINAL MPX DELIVERABLE Due when you schedule your interview and presentation.
AHCI: ATAport Miniport Example. Outline AHCI Features Goals Basics AHCI ATA Miniport Design Philosophy Memory Structures and Resources Enumeration IO.
Process Description and Control A process is sometimes called a task, it is a program in execution.
Experience with Processes and Monitors in Mesa
We will focus on operating system concepts What does it do? How is it implemented? Apply to Windows, Linux, Unix, Solaris, Mac OS X. Will discuss differences.
1 I/O Management in Representative Operating Systems.
1 Lecture 4: Threads Operating System Fall Contents Overview: Processes & Threads Benefits of Threads Thread State and Operations User Thread.
Silberschatz, Galvin and Gagne Applied Operating System Concepts Chapter 2: Computer-System Structures Computer System Architecture and Operation.
MODERN OPERATING SYSTEMS Third Edition ANDREW S. TANENBAUM Chapter 11 Case Study 2: Windows Vista Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall,
Computer-System Structures Er.Harsimran Singh
By Lecturer / Aisha Dawood 1. You can control the number of dispatcher processes in the instance. Unlike the number of shared servers, the number of.
OPERATING SYSTEM OVERVIEW. Contents Basic hardware elements.
Operating System Program 5 I/O System DMA Device Driver.
Cs238 Lecture 3 Operating System Structures Dr. Alan R. Davis.
Sem 2v2 Chapter 5 Router Startup and Setup. A router initializes by loading the bootstrap, the operating system, and a configuration file. If the router.
1 - Oracle Server Architecture Overview
Driver Verifier Advancements In Windows 7 Daniel Mihai Principal Software Design Engineer Windows Engineering Tools.
© 2008, Renesas Technology America, Inc. All Rights Reserved The RCAN-ET peripheral and the CAN API SH2 & SH2A MCUs V 1.2 Mar 2010.
Kumar Rajeev SDET Microsoft Corporation. KMDF does not support HID minidrivers natively due to conflicting KMDF and HID architecture requirements HID.
Installing Windows XP Professional Using Attended Installation Slide 1 of 35Session 9 Ver. 1.0 CompTIA A+ Certification: A Comprehensive Approach for all.
®® Microsoft Windows 7 for Power Users Tutorial 8 Troubleshooting Windows 7.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 12: Managing and Implementing Backups and Disaster Recovery.
I/O Systems ◦ Operating Systems ◦ CS550. Note: Based on Operating Systems Concepts by Silberschatz, Galvin, and Gagne Strongly recommended to read.
© 2017 SlidePlayer.com Inc. All rights reserved.