IRP_MN_MOUNT_VOLUME question

NTFSD
1

Hi,

I am learning SFilter sample from IFS Kit & need to develop a legacy FSFD
for Win2K.
I have to attach a device object for each VDO & create a shadowdevice.
My test machine has Win2K with two NTFS partitions, but SFilter receives
IRP_MN_MOUNT_VOLUME thrice.
Why does I/O manager send IRP_MN_MOUNT_VOLUME thrice for two partitions?

Thanks
Ziahul

2

> IRP_MN_MOUNT_VOLUME thrice.

Why does I/O manager send IRP_MN_MOUNT_VOLUME thrice for two
partitions?

IO manager enumerates all registered FSDs and asks each of them to mount. The
enumeration stops either on success (the real mount) or on error other then
STATUS_UNRECOGNIZED_VOLUME.

Your picture is:

  • NTFS - STATUS_UNRECOGNIZED_VOLUME
  • UDFS - STATUS_UNRECOGNIZED_VOLUME
  • FASTFAT - success

or so.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Hi Maxim,

IRP_MN_MOUNT_VOLUMEs are targeted to

  • \Device\HarddiskVolume1
  • \Device\Harddisk0\DR0
  • \Device\HarddiskVolume2

Thats why i am seeing one extra mount operations. So device objects created
by disk class driver that represent disk ( \Device\Harddisk0\DR0 ) &
partitions get mount request.
Correct me, if i’m wrong.

Thanks
Ziahul

On 4/3/07, Maxim S. Shatskih wrote:
>
> > IRP_MN_MOUNT_VOLUME thrice.
> > Why does I/O manager send IRP_MN_MOUNT_VOLUME thrice for two
> >partitions?
>
> IO manager enumerates all registered FSDs and asks each of them to mount.
> The
> enumeration stops either on success (the real mount) or on error other
> then
> STATUS_UNRECOGNIZED_VOLUME.
>
> Your picture is:
> - NTFS - STATUS_UNRECOGNIZED_VOLUME
> - UDFS - STATUS_UNRECOGNIZED_VOLUME
> - FASTFAT - success
>
> or so.
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

1 - \Device\HarddiskVolume1 = name of the device object for volume C:
2 - \Device\Harddisk0\DR0 = name of the device object for first physical
disk
3 - \Device\HarddiskVolume2 = name of the device object for volume D:

Mount calls are “for volumes” and “not for physical disk and partitions”.
So only 1 and 3 are correct…you will not get call for 2.

as Maxim said a typical scenario would be:

1 - NTFS gets mount for c: (\Device\HarddiskVolume1) - success
2 - NTFS gets mount for D: (\Device\HarddiskVolume2) -
STATUS_UNRECOGNIZED_VOLUME
3 - FASTFAT (will be loaded by fs_rec) gets mount for D:
(\Device\HarddiskVolume2) - success

===============================================

Hi Maxim,

IRP_MN_MOUNT_VOLUMEs are targeted to

  • \Device\HarddiskVolume1
  • \Device\Harddisk0\DR0
  • \Device\HarddiskVolume2

Thats why i am seeing one extra mount operations. So device objects created
by disk class driver that represent disk ( \Device\Harddisk0\DR0 ) &
partitions get mount request.
Correct me, if i’m wrong.

Thanks
Ziahul

On 4/3/07, Maxim S. Shatskih wrote:
> IRP_MN_MOUNT_VOLUME thrice.
> Why does I/O manager send IRP_MN_MOUNT_VOLUME thrice for two
>partitions?

IO manager enumerates all registered FSDs and asks each of them to mount.
The
enumeration stops either on success (the real mount) or on error other
then
STATUS_UNRECOGNIZED_VOLUME.

Your picture is:
- NTFS - STATUS_UNRECOGNIZED_VOLUME
- UDFS - STATUS_UNRECOGNIZED_VOLUME
- FASTFAT - success

or so.

–
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com