Bus filter?

OSR_Community_User · August 28, 2002, 1:38am

Hi,
I need to write Scsi monitor driver to monitor all scsi request.
Since there are no documentation about how to do so, I assumed I need to
find the PDOs that the scsiport.sys created and filter them.
I did it using IRP_MN_QUERY_DEVICE_RELATIONS and attaching to the PDO
that I found.
Then I started to see some SCSI request but soon a blue screen appears

I’m really need help here, can some one direct me to a sample or
documentation of how to do it correctly?

Sincerely
Omri

OSR_Community_User · August 28, 2002, 3:13am

Is the driver that you are going to filter a PnP?
If yes, your driver should also follow PnP rules. this mean that your driver
need to report about its childrens (in BusRelation) and add them to the list.
This is just one step in the whole implementation of PnP.

OS.
----- Original Message -----
From: Omri Kessel
To: NT Developers Interest List
Sent: Wednesday, August 28, 2002 7:33 AM
Subject: [ntdev] Bus filter?

Hi,

I need to write Scsi monitor driver to monitor all scsi request.

Since there are no documentation about how to do so, I assumed I need to find the PDOs that the scsiport.sys created and filter them.

I did it using IRP_MN_QUERY_DEVICE_RELATIONS and attaching to the PDO that I found.

Then I started to see some SCSI request but soon a blue screen appears L

I’m really need help here, can some one direct me to a sample or documentation of how to do it correctly?

Sincerely

Omri

You are currently subscribed to ntdev as: xxxxx@hotmail.com
To unsubscribe send a blank email to %%email.unsub%%

Mark_Roddy · August 28, 2002, 8:19am

Well actually no, a bus filter driver filters the bus FDO and attaches
to PDO device objects reported by the bus fdo in query device relations.

If the original poster just wants a functional scsi trace application he
can download HtsScsiView from my website. It is a scsi bus filter driver
and an application that cooperate to trace scsi requests. The app and
driver are free, no source code though

===========================
Mark Roddy
Consultant, Microsoft DDK MVP
Hollis Technology Solutions
xxxxx@hollistech.com
www.hollistech.com
603-321-1032

-----Original Message-----
From: “osml”
To: “NT Developers Interest List”
Date: Wed, 28 Aug 2002 10:12:09 +0200
Subject: [ntdev] Re: Bus filter?

> Is the driver that you are going to filter a PnP?
> If yes, your driver should also follow PnP rules. this mean that your
> driver
> need to report about its childrens (in BusRelation) and add them to the
> list.
> This is just one step in the whole implementation of PnP.
>
> OS.
> ----- Original Message -----
> From: Omri Kessel
> To: NT Developers Interest List
> Sent: Wednesday, August 28, 2002 7:33 AM
> Subject: [ntdev] Bus filter?
>
>
> Hi,
>
> I need to write Scsi monitor driver to monitor all scsi request.
>
> Since there are no documentation about how to do so, I assumed I need
> to find the PDOs that the scsiport.sys created and filter them.
>
> I did it using IRP_MN_QUERY_DEVICE_RELATIONS and attaching to the PDO
> that I found.
>
> Then I started to see some SCSI request but soon a blue screen
> appears L
>
> I’m really need help here, can some one direct me to a sample or
> documentation of how to do it correctly?
>
>
>
> Sincerely
>
> Omri
>
> —
> You are currently subscribed to ntdev as: xxxxx@hotmail.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@hollistech.com
> To unsubscribe send a blank email to %%email.unsub%%
>

OSR_Community_User · August 28, 2002, 1:12pm

After doing so debuging here is what I found.
the ScsiPort fail in its SCSIPORT!ScsiPortStartIo

as we can see from the stack the start of the command that cause the
failure is in the diskwmi.c (I compiled the disk sample and install it to
get more debug)
in the DiskPerformSmartCommand method.
in my filter I’m recieving this command in my standard redirection method:

NTSTATUS OnaSendToNextDriver(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
PCOMMON_EXTENSION deviceExtension;
PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp
);

IoSkipCurrentIrpStackLocation(Irp);
deviceExtension = (PCOMMON_EXTENSION) DeviceObject->DeviceExtension;
return IoCallDriver(deviceExtension->AttachedDevice, Irp);
} // end OnaSendToNextDriver()

Any Ideas?

this is the Stack trace:

nt!RtlpBreakWithStatusInstruction
nt!KiBugCheckDebugBreak+0x19
nt!KeBugCheck2+0x43c
nt!KeBugCheckEx+0x19
nt!KiTrap0E+0x2ad
SCSIPORT!ScsiPortStartIo+0x211
nt!IopStartPacket+0x9f
nt!IoStartPacket+0x99
SCSIPORT!ScsiPortFdoDispatch+0x26c
SCSIPORT!SpDispatchRequest+0x65
SCSIPORT!ScsiPortPdoScsi+0xea
SCSIPORT!ScsiPortGlobalDispatch+0x1a
nt!IopfCallDriver+0x31
onaflt!OnaSendToNextDriver+0x8b [c:\myproject\drivers\onaflt\onaflt.cpp @
983]
nt!IopfCallDriver+0x31
disk!DiskPerformSmartCommand+0x3ea
[c:\winddk\2600\src\storage\class\disk\diskwmi.c @ 764]
disk!DiskGetIdentifyInfo+0x76
[c:\winddk\2600\src\storage\class\disk\diskwmi.c @ 789]
disk!DiskDetectFailurePrediction+0x73
[c:\winddk\2600\src\storage\class\disk\diskwmi.c @ 1809]
disk!DiskInitFdo+0x3f0 [c:\winddk\2600\src\storage\class\disk\pnp.c @ 508]
CLASSPNP!ClassPnpStartDevice+0x359
[c:\winddk\2600\src\storage\class\classpnp\class.c @ 1454]
CLASSPNP!ClassDispatchPnp+0x1ac
[c:\winddk\2600\src\storage\class\classpnp\class.c @ 593]
nt!IopfCallDriver+0x31
PartMgr!PmPnp+0x247
nt!IopfCallDriver+0x31
nt!IopSynchronousCall+0xb8
nt!IopStartDevice+0x4a
nt!PipProcessStartPhase1+0x4c
nt!PipProcessDevNodeTree+0x171
nt!PipDeviceActionWorker+0xa1
nt!PipRequestDeviceAction+0x105
nt!IopInitializeBootDrivers+0x380
nt!IoInitSystem+0x60a
nt!Phase1Initialization+0x83b
nt!PspSystemThreadStartup+0x34
nt!KiThreadStartup+0x16

Well actually no, a bus filter driver filters the bus FDO and attaches
to PDO device objects reported by the bus fdo in query device relations.

If the original poster just wants a functional scsi trace application he
can download HtsScsiView from my website. It is a scsi bus filter driver
and an application that cooperate to trace scsi requests. The app and
driver are free, no source code though

===========================
Mark Roddy
Consultant, Microsoft DDK MVP
Hollis Technology Solutions
xxxxx@hollistech.com
www.hollistech.com
603-321-1032

-----Original Message-----
From: “osml”
> To: “NT Developers Interest List”
> Date: Wed, 28 Aug 2002 10:12:09 +0200
> Subject: [ntdev] Re: Bus filter?
>
> > Is the driver that you are going to filter a PnP?
> > If yes, your driver should also follow PnP rules. this mean that your
> > driver
> > need to report about its childrens (in BusRelation) and add them to the
> > list.
> > This is just one step in the whole implementation of PnP.
> >
> > OS.
> > ----- Original Message -----
> > From: Omri Kessel
> > To: NT Developers Interest List
> > Sent: Wednesday, August 28, 2002 7:33 AM
> > Subject: [ntdev] Bus filter?
> >
> >
> > Hi,
> >
> > I need to write Scsi monitor driver to monitor all scsi request.
> >
> > Since there are no documentation about how to do so, I assumed I need
> > to find the PDOs that the scsiport.sys created and filter them.
> >
> > I did it using IRP_MN_QUERY_DEVICE_RELATIONS and attaching to the PDO
> > that I found.
> >
> > Then I started to see some SCSI request but soon a blue screen
> > appears L
> >
> > I’m really need help here, can some one direct me to a sample or
> > documentation of how to do it correctly?
> >
> >
> >
> > Sincerely
> >
> > Omri
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@hotmail.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@hollistech.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >

OSR_Community_User · August 28, 2002, 3:27pm

“Omri” wrote in message news:xxxxx@ntdev…
>
> After doing so debuging here is what I found.
> the ScsiPort fail in its SCSIPORT!ScsiPortStartIo
>
>
> as we can see from the stack the start of the command that cause the
> failure is in the diskwmi.c (I compiled the disk sample and install it to
> get more debug)
> in the DiskPerformSmartCommand method.
> in my filter I’m recieving this command in my standard redirection method:
>
> NTSTATUS OnaSendToNextDriver(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
> {
> PCOMMON_EXTENSION deviceExtension;
> PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation( Irp
> );
>
> IoSkipCurrentIrpStackLocation(Irp);
> deviceExtension = (PCOMMON_EXTENSION) DeviceObject->DeviceExtension;
> return IoCallDriver(deviceExtension->AttachedDevice, Irp);

You don’t show how you are assigning deviceExtension->AttachedDevice. If
that isn’t the right DO, then you are in a world of hurt. My guess is
that’s pointing to the wrong object.

I think the Toaster filter and diskperf samples show the appropriate means
of assigning that pointer:

IoCreateDevice(DriverObject,blah,blah,blah,blah,blah,&myFilterDO)
//error handling
IoAttachDeviceToDeviceStack(myFilterDO, DeviceObjectPassedInAsParam2)

If that’s not how to attache to the SCSI stack to filter it, I will find out
real soon, since I am doing something similar, though for a different
purpose.

If you really need the SCSI IO tracer, and you aren’t doing this as a
starting point for something else, get Mark’s HtsScsiView from
http://www.hollistech.com. Save you a lot of time and headache. Just do
your analysis on the output from that.

Phil
–
Philip D. Barila
Seagate Technology, LLC
(720) 684-1842

OSR_Community_User · August 28, 2002, 3:52pm

The HtsScsiView Is what I need but this is only the starting point.

as for how I attached the PDO
I did it in two phases.
The first phase I install upper filter for the SCSI class and in its
addDevice I Attach to the SCSI FDO I did it same way as its documented and
this approach working well for instance if I want to install lower filters
for the Disk class
so the main idea is the Attach to the PhysicalDeviceObject I got in
AddDevice

the Second and the more tricky thing is to attach to the actual Disk PDO
since this PDO is created as far as I understand ( and I’m new in this
field) by the SCSI Driver, and the Disk FDO directly send its request to
this PDO and there for doesn’t goes through the SCSI FDO which means I
can’t get the SCSI requests. so what I did here is to add dispatch routine
to the PnP which monitor the IRP_MN_QUERY_DEVICE_RELATIONS
there I check if QueryDeviceRelation.Type==BusRelations and if so
I send the IRP to the lower device and wait for its response (using
completion routine)
when the call to the lower driver completed I extract the relation from
the Irp (Irp->IoStatus.Information)
and for each relation
create a new device (IoCreateDevice) using my existing Driver pointer
Attach the new Device to each device from the relation
(Relation->Object[i] ( this actually attach to my adaptec device)

is there something wrong with this process?