IOCTL codes

I’m writing a file system filter driver, in this driver I create a
symbolic link. When I call CreateFile
in my user mode process to open this symbolic link I am receving
IOCTL command codes I dont
recognise, on receipt of these commands I simply do an
IoCompleteRequest and
return STATUS_INVALID_DEVICE_REQUEST.

I wonder if anyody out there has seen this before, I dont understand
who is sending these or why?
Mostly this return works, but it has caused crashes, particularly
when explorer is running. I am testing
on NT4 debug, sp6, I know there was a bug in this area prior to sp2.

Could anybody shed light on this, or tell me a work around (ie
should I call IoCallDriver when I receve
unrecognised dcommands???)

Thanks Gavin.

Your application is not the only one sending irp’s (e.g. IOCTLS) to your
filter.
Every thread that is doing an io operation will result in an IOCTL to your
driver (unless you distinguish between specific calls to your device and
calls that just pass thru your filter ).
If this is the case (you don’t have 2 separate dispatch functions) you
should pass on to the file system with IoCallDriver any irp you don’t know.

At 06:46 AM 4/17/00 -0400, you wrote:

I’m writing a file system filter driver, in this driver I create a
symbolic link. When I call CreateFile
in my user mode process to open this symbolic link I am receving
IOCTL command codes I dont
recognise, on receipt of these commands I simply do an
IoCompleteRequest and
return STATUS_INVALID_DEVICE_REQUEST.

I wonder if anyody out there has seen this before, I dont understand
who is sending these or why?
Mostly this return works, but it has caused crashes, particularly
when explorer is running. I am testing
on NT4 debug, sp6, I know there was a bug in this area prior to sp2.

Could anybody shed light on this, or tell me a work around (ie
should I call IoCallDriver when I receve
unrecognised dcommands???)

Thanks Gavin.


You are currently subscribed to ntfsd as: xxxxx@goman.co.il
To unsubscribe send a blank email to $subst(‘Email.Unsub’)

Best regards

Itai Shaham R&D
xxxxx@goman.co.il Goman Research Ltd.
www.goman.co.il
Office: +972-3-9024725 Ext:239
ICQ UIN: 3607281

The proper thing to do with IOCTL’s you don’t understand is to pass them on
to the next lower driver in the stack. ONLY if you are at the bottom of the
stack (ie. the actual device driver for the disk) should you return
invalid_device_request. There are a number of ioctls that get passed down
to the lower levels that you won’t understand, some are fully undocumented,
like all of the FTDISK stuff, which MUST trickle all the way down.

Anyway, the rule is, if you’re the bottom level driver (you’re an FSD, so
this isn’t the case) return invaild_device_request, otherwise, pass the
ioctl down to the next lower driver (who may in turn pass it down if it
doesn’t recognize it, and so forth, till it hits the bottom of the stack)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of
xxxxx@emc.com
Sent: Monday, April 17, 2000 5:46 AM
To: File Systems Developers
Subject: [ntfsd] IOCTL codes

I’m writing a file system filter driver, in this driver I create a
symbolic link. When I call CreateFile
in my user mode process to open this symbolic link I am receving
IOCTL command codes I dont
recognise, on receipt of these commands I simply do an
IoCompleteRequest and
return STATUS_INVALID_DEVICE_REQUEST.

I wonder if anyody out there has seen this before, I dont understand
who is sending these or why?
Mostly this return works, but it has caused crashes, particularly
when explorer is running. I am testing
on NT4 debug, sp6, I know there was a bug in this area prior to sp2.

Could anybody shed light on this, or tell me a work around (ie
should I call IoCallDriver when I receve
unrecognised dcommands???)

Thanks Gavin.


You are currently subscribed to ntfsd as: xxxxx@xiotech.com
To unsubscribe send a blank email to $subst(‘Email.Unsub’)