3

I'm debugging a driver with WinDbg. In the DriverUnload function, there's a call to KdBreakPoint().

When I disable the device from device manager, WinDbg breaks into the DriverUnload function.

But when I shutdown or restart Windows (through Start > Shutdown), the debugger doesn't break. So the question is: why does windows not call the DriverUnload function at restart or shutdown?

(BTW: I have already added breakpoints to the PNP dispatch function to catch IRP_MN_QUERY_REMOVE_DEVICE / IRP_MN_REMOVE_DEVICE / IRP_MN_QUERY_STOP_DEVICE / IRP_MN_STOP_DEVICE, the result is the same)

huysentruitw
  • 27,376
  • 9
  • 90
  • 133
  • Hmm, you have properly registered the routine though (`DriverObject->DriverUnload`)? It's not sufficient to name it something. In The Olden Times (tm), Windows used to call `DriverUnload` on shutdown. I don't think they could change the semantics there without causing severe breakage. – 0xC0000022L Jul 12 '12 at 12:53
  • I don't think DriverUnload will be called for each driver during shutdown. – Rohan Jul 12 '12 at 12:57
  • @0xC0000022L: yes it is attached, the debugger breaks into the DriverUnload function when I disable the device from the device manager, so I'm sure it works :) – huysentruitw Jul 12 '12 at 12:58
  • @Rohan: I have a thread running that can write values into an attached EEPROM. To prevent EEPROM corruption, I want to stop that thread safely before Windows pulls out the power. Thinking of it, I might be able to stop the thread in the power handler before the system goes down. – huysentruitw Jul 12 '12 at 13:01
  • `DriverUnload` is probably to free misc resources (such as freeing memory). Hence - it's ignored during system shutdown. Device-related stuff should be at `IRP_MN_REMOVE_DEVICE` or `IRP_MJ_CLOSE`. – valdo Jul 12 '12 at 13:16
  • @valdo: my driver doesn't receive the `IRP_MN_REMOVE_DEVICE` on restart/shutdown, only when I disable the device. `IRP_MJ_CLOSE` is only issued when an other process calls `CloseHandle` on a handle to my device, which is not the case (there are no open handles at the point of shutdown). – huysentruitw Jul 12 '12 at 13:25

1 Answers1

3

Ah, the solution is "easy". It's not being called at all. I had to look it up, though.

The Windows 2000 Device Driver Book: A Guide for Programmers states:

A driver's Unload routine is not called at system shutdown time.

Also see this thread.

If you have a WDM driver use DispatchShutdown (IRP_MJ_SHUTDOWN).

Also check out the WDK (7600) documentation on "shutdown dispatch routines [WDK kernel]" and "shutdown power management [WDK kernel]".

0xC0000022L
  • 20,597
  • 9
  • 86
  • 152
  • Great book, I have the WDM book of Walter Oney in front of me, and he doesn't mention that. – huysentruitw Jul 12 '12 at 13:02
  • Funny, in the thread you're mentioning, the OP says DriverUnload was called under XP, well I'm using XP (embedded) and it doesn't work. Hmm, it's the first time I'm seeing that MajorFunction `IRP_MJ_SHUTDOWN`, I'll try it out, thank you! – huysentruitw Jul 12 '12 at 13:06
  • Seems like `IRP_MJ_SHUTDOWN` is for file system drivers. But I could use `IRP_MJ_POWER/IRP_MN_SET_POWER` and look for `PowerSystemShutdown`. Thanks for pointing me the right direction. – huysentruitw Jul 12 '12 at 14:05