none
OEM PnP Lockdown' protection on file RRS feed

  • Question

  • Hi!

    I have a driver package whose INF sets PnPLockDown = 1 in the inf. However, I occasionally see reboots are required following a driver update. The setupapi.dev.log file shows the following:

         flq:                                    {FILE_QUEUE_COMMIT_COPY_SUBQUEUE}
         flq:                                         Source Media:
         flq:                                              SourcePath   - [C:\Windows\System32\DriverStore\FileRepository\test.inf_amd64_34f7a0cec0727b16]
         flq:                                              SourceFile   - [test.sys]
         flq:                                              Flags        - 0x00000000
         flq:                                         {FILE_QUEUE_COMMIT_COPY_FILE}
         flq:                                              {FILE_QUEUE_BACKUP_FILE}
         flq:                                                   CopyFile: 'C:\Windows\System32\drivers\test.sys' to 'C:\Windows\Temp\OLDE4D3.tmp'
         flq:                                              {FILE_QUEUE_BACKUP_FILE exit OK}
         flq:                                              Hardlinking 'C:\Windows\System32\DriverStore\FileRepository\test.inf_amd64_34f7a0cec0727b16\test.sys' to 'C:\Windows\System32\drivers\test.sys'.
    !    flq:                                              HardLink: 'C:\Windows\System32\DriverStore\FileRepository\test.inf_amd64_34f7a0cec0727b16\test.sys' to 'C:\Windows\System32\drivers\test.sys' FAILED!
    !    flq:                                              Error 32: The process cannot access the file because it is being used by another process.
    !    flq:                                              CopyFile: 'C:\Windows\System32\DriverStore\FileRepository\test.inf_amd64_34f7a0cec0727b16\test.sys' to 'C:\Windows\System32\drivers\test.sys' FAILED!
    !    flq:                                              Error 32: The process cannot access the file because it is being used by another process.
         flq:                                              CopyFile: 'C:\Windows\System32\DriverStore\FileRepository\test.inf_amd64_34f7a0cec0727b16\test.sys' to 'C:\Windows\System32\drivers\SETE4D3.tmp'
         flq:                                              {SPFQNOTIFY_FILEOPDELAYED}
         idb:                                                   Last driver package 'test.inf_amd64_e6afb9b79a443e6e' to copy 'C:\Windows\System32\drivers\test.sys' needs reconfiguration.
         cpy:                                                   Applied 'OEM PnP Lockdown' protection on file 'C:\Windows\System32\drivers\test.sys'.
         flq:                                              {SPFQNOTIFY_FILEOPDELAYED - returned 0x00000006}
         flq:                                              Caller applied security to file 'C:\Windows\System32\drivers\test.sys'.
    !    flq:                                              Targetfile 'C:\Windows\System32\drivers\test.sys' marked to be moved from 'C:\Windows\System32\drivers\SETE4D3.tmp' on next reboot.'

    I believe this is a side-effect of using the PnPLockDown directive in my INF. Is there a way to override this protection for driver updates?

    Thanks!

    Tuesday, March 7, 2017 2:09 AM

Answers

  • Make sure you don't have a leaked Ob ref which will keep image loaded after DriverUnloaf is called. I don't know if lm is reporting the DriverUnload state or if it takes into account the leaked Ob ref keeping the image in memory

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    • Marked as answer by Soquel Dude Monday, June 8, 2020 4:51 PM
    Wednesday, March 8, 2017 2:17 AM

All replies

  • more than likely the file test.sys is still loaded. starting in win10 drivers are backed by the sys file, not the system page file. this means that pre win10 you could remove, copy over, etc the original file while the driver was loaded, but that is no longer possible.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Tuesday, March 7, 2017 4:46 AM
  • Thanks, Doran!

    I did a quick test on my test.sys package. I first uninstalled the device through DM (along with all related driver software for the device). After I forced a bus scan, I entered lm through WinDbg and saw that test.sys was listed as an unloaded module.

    I then upgraded the driver software. Once it completed, I was again prompted for a reboot. At this point, I again broke into the debugger and entered lm. My driver was still listed as an unloaded module.

    So, it still seems like using PnPLockDown in the INF is causing some blocking issue on updating driver binaries. Any suggestion about other things to try?

    Tuesday, March 7, 2017 11:32 PM
  • Make sure you don't have a leaked Ob ref which will keep image loaded after DriverUnloaf is called. I don't know if lm is reporting the DriverUnload state or if it takes into account the leaked Ob ref keeping the image in memory

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    • Marked as answer by Soquel Dude Monday, June 8, 2020 4:51 PM
    Wednesday, March 8, 2017 2:17 AM