I am new to the area and I am trying to fix a defect in a legacy filter driver. My legacy driver has a shadow folder and I can select folder(s) that I would like to shadow. The problem now is that Windows Explorer hangs when I would shadow the folder c:\user\me\documents; where there is no problem when I would shadow the folder c:\foo. Windows Explorer hangs when I open the Explorer, select the document folder, and close the Explorer for a few times. Quick is looking for something …
I have read every post in this forum about “Windows Explorer hangs” and it is very helpful.
- I use the !locks and did not see any pending lock.
- I use Windbg to check the Explorer process, I find many threads’ info as
THREAD ffffe0016eb96080 Cid 0c98.0988 Teb: 0000000000c64000 Win32Thread: ffffe0016b68bad0 WAIT: (UserRequest) UserMode Alertable
ffffe0016eb9bd40 NotificationEvent
ffffe0016eba8760 SynchronizationEvent
Not impersonating
DeviceMap ffffc001c6e3c620
Owning Process ffffe0016ea97080 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 6601 Ticks: 56 (0:00:00:00.875)
Context Switch Count 4307 IdealProcessor: 0
UserTime 00:00:00.015
KernelTime 00:00:00.062
Win32 Start Address 0x00007ffd5b84c1c0
Stack Init ffffd000218ecc90 Current ffffd000218ebf80
Base ffffd000218ed000 Limit ffffd000218e7000 Call 0000000000000000
Priority 12 BasePriority 8 PriorityDecrement 2 IoPriority 2 PagePriority 5
Child-SP RetAddr Call Site
ffffd000218ebfc0 fffff800
086eb84a nt!KiSwapContext+0x76
ffffd000218ec100 fffff800
086eb2d9 nt!KiSwapThread+0x15a
ffffd000218ec1b0 fffff800
086ea71e nt!KiCommitThreadWait+0x149
ffffd000218ec240 fffff800
08ac7b9d nt!KeWaitForMultipleObjects+0x24e
ffffd000218ec300 fffff800
08a0a586 nt!ObWaitForMultipleObjects+0x2bd
ffffd000218ec810 fffff800
087691a3 nt!NtWaitForMultipleObjects+0xf6
ffffd000218eca90 00007ffd
72965c34 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000218ecb00) 00000000
050df958 00000000`00000000 ntdll!NtWaitForMultipleObjects+0x14
3. from what I am reading, it looks like an oplock issue.
I would appreciate it if some experts can give me some hints.
a). I can see which files have been accessed by Explorer in my debug info, but is there a way for me to see which file causes the hanging?
b). I can see the driver recevies IRP_MJ_FILE_SYSTEM_CONTROL and IRP_MN_USER_FS_REQUEST, which could be oplock information.
However, when I check irpSp->Parameters.fsControlCode, it is 0 that does not make too much sense to me.
c). I am not very experienced in using windbg, can I get more information from TrapFrame @ ffffd000`218ecb00?
d). there are 20+ threads, is there a way to see which threads are hanging?
e). is there anything obvious I am missing or I did not do?
Thanks in advance
Xinren