I’m new to KMDF and have a question. I’ve a volume upper filter driver and wants to detect if the volume, to which it is attached, is going offline in MSCS. What I want to do in my driver is to write a file before the volume goes offline. Is this possible and if so how?
I’ve been reading about PNP state wdf_device_pnp_state enum but I don’t see any of the WDK example using it. Can I use that in filter driver?
wdf_device_pnp_state will not solve your problem at all. It is a list of every pnp state in the kmdf pnp state machine. If an offline operation is reflected as a pnp operation, normal power up /down callbacks in KMDF are sufficient.
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Friday, April 20, 2012 12:08 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Detecting volume going offline in cluster
I’m new to KMDF and have a question. I’ve a volume upper filter driver and wants to detect if the volume, to which it is attached, is going offline in MSCS. What I want to do in my driver is to write a file before the volume goes offline. Is this possible and if so how?
I’ve been reading about PNP state wdf_device_pnp_state enum but I don’t see any of the WDK example using it. Can I use that in filter driver?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Doron,
Thanks for the quick response. Do you suggest I register for IPR preprocess for IRP_MJ_POWER? I’m currently using pre process handler for IRP_MJ_PNP and also have device control handler for IO queue. Should I register EvtIoStop?
In my testing I’m seeing that my filter driver is getting IRP_MJ_SURPRISE_REMOVAL for shared volume in cluster (not CSV) when I take volume offline? Isn’t offline of clustered volume an orderly removal of volume?
This is not going to be solved by wdm preprocess routines. Why do you have a preprocess routine for pnp to begin with?
You have to answer the fundamental question though. Does an offline operation turn into a pnp operation?
A surprise removal irp can happen if the bus reports the device as missing (probably not happening in this case) or a software failure in the stack (such as calling WdfDeviceSetFailed). I would bet your driver, another driver in the stack is possible though, is causing the surprise remove irp to be sent.
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Friday, April 20, 2012 12:52 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting volume going offline in cluster
Doron,
Thanks for the quick response. Do you suggest I register for IPR preprocess for IRP_MJ_POWER? I’m currently using pre process handler for IRP_MJ_PNP and also have device control handler for IO queue. Should I register EvtIoStop?
In my testing I’m seeing that my filter driver is getting IRP_MJ_SURPRISE_REMOVAL for shared volume in cluster (not CSV) when I take volume offline? Isn’t offline of clustered volume an orderly removal of volume?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
I’ve wdm preprocess for IRP_MJ_SHUTDOWN to write file to volume at the time of shutdown. In that handler I can see that disk is writable and volume is not offline. This tells me that I would be able to write to a file to same volume during system shutdown. I want to do similar thing when cluster volume goes offline.
I also thought that may be my driver is causing surprise removal by leaving handle open. I’m going to investigate that. But an offline of clustered volume shouldn’t cause surprise removal, right?
I don’t think offiline == surprise removal. If you have open handles, the query remove will fail unless you register for file handle notifications and close the handle on the query remove notification.
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Friday, April 20, 2012 1:21 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting volume going offline in cluster
I’ve wdm preprocess for IRP_MJ_SHUTDOWN to write file to volume at the time of shutdown. In that handler I can see that disk is writable and volume is not offline. This tells me that I would be able to write to a file to same volume during system shutdown. I want to do similar thing when cluster volume goes offline.
I also thought that may be my driver is causing surprise removal by leaving handle open. I’m going to investigate that. But an offline of clustered volume shouldn’t cause surprise removal, right?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Any suggestion on how I can handle cluster volume offline like I handle shutdown.
I think you should be looking for IOCTL_STORAGE_BREAK_RESERVATION from the
cluster driver.
Although I am not entirely sure if you see that in volume filter driver. I
know you see that in the disk filter driver.
On Fri, Apr 20, 2012 at 1:31 PM, wrote:
> Any suggestion on how I can handle cluster volume offline like I handle
> shutdown.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Atul,
Thanks for the reply.
I tried that but I don’t see that in my volume upper filter. Here is how I’m trying to capture it. I’ve handler for EvtIoDeviceControl for IO queue for my filter WDF device. I can see IOCTL_DISK_IS_WRITABLE in same handler along with other, but not this one. May be volume manager is issuing it to disk.
I see a control code 0x5300ac when I take a clustered volume offline. Wonder what it is for.
>I don’t think offiline == surprise removal.
You’re correct, I’ve looked at this experimentally.
What the cluster stuff does to failover the non-CSV disk from one node to another is to make the disk offline (as visible in the Disk Management) on the node which is no more the disk’s owner.
As about reserve/release stuff - this is IIRC for quorum disk only, and not related to disk IO at all - it is related to cluster node keepalive stuff.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Doron wrote:
This is not going to be solved by wdm preprocess routines. Why do you have a
preprocess routine for pnp to begin with?
The reason I had wdm preprocess for IRP_MJ_PNP because I started with OSR kmdf filter driver sample.
I then removed called to WdfDeviceInitAssignWdmIrpPreprocessCallback(IRP_MJ_PNP). Now I only have pnp power call back registration in my EvtDeviceAdd().
pnpPowerCallbacks.EvtDeviceD0Entry = WdfFltrD0Entry;
pnpPowerCallbacks.EvtDeviceD0Exit = WdfFltrD0Exit;
pnpPowerCallbacks.EvtDeviceSelfManagedIoSuspend = WdfFltrEvtDeviceSelfManagedIoSuspend;
pnpPowerCallbacks.EvtDeviceSelfManagedIoInit = WdfFltrEvtDeviceSelfManagedIoInit;
pnpPowerCallbacks.EvtDeviceQueryRemove = WdfFltrQueryRemove;
pnpPowerCallbacks.EvtDeviceQueryStop = WdfFltrQueryStop;
pnpPowerCallbacks.EvtDeviceSurpriseRemoval = WdfFltrEvtDeviceSurpriseRemoval;
Later I create queue for my filter device.
ioQueueConfig.PowerManaged = WdfFalse;
ioQueueConfig.EvtIoDeviceControl = WdfFltrDeviceControl;
ioQueueConfig.EvtIoInternalDeviceControl = WdfFltrInternalDeviceControl;
ioQueueConfig.EvtIoStop = WdfFltrEvtIoStop;
I’ve also removed code for creating control device that was being created for user level app.
With this code when a volume comes online in MSCS, my driver create a new device and attaches to it. Do power up and SelfManagedIoInit.
When I remove the deivce I see following call back function called.
WdfFltrEvtDeviceSurpriseRemoval
WdfFltrEvtDeviceSelfManagedIoSuspend
WdfFltrD0Exit
WdfFltrEvtDeviceContextCleanup // handler set as obj prop before WdfDeviceCreate
WdfFltrEvtDeviceDestroy // handler set as obj prop before WdfDeviceCreate
Does call to WdfFltrEvtDeviceSurpriseRemoval() is expected? Should I see call to QueryRemove/Stop handler when I take volume resource offline in MSCS?
Since my driver is KMDF filter, WdfFdoInitSetFilter(DeviceInit);, I’m not seeing call to queryRemove/stop.
But then why WdfFltrEvtDeviceSurpriseRemoval is called before WdfFltrEvtDeviceSelfManagedIoSuspend? Is it not possible for KMDF filter to access the volume before it goes offline.
WdfFltrEvtDeviceSurpriseRemoval is called outside of any of the pnp/power callback sequence. WdfFltrEvtDeviceSurpriseRemoval is a pretty dangerous function, you could easily race with a power transition for instance. In this specific case, this is by design. The surprise remove comes in, kmdf calls WdfFltrEvtDeviceSurpriseRemoval and then powers down the device and that calls WdfFltrEvtDeviceSelfManagedIoSuspend. As to why the offline operation turns into a surprise remove, I don’t know. I think someone else’s suggestion that you look at the disk or partition pnp stacks to see what is going on there might lead you the answer as to why the volume is being surprise removed.
d
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Tuesday, April 24, 2012 10:00 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting volume going offline in cluster
Since my driver is KMDF filter, WdfFdoInitSetFilter(DeviceInit);, I’m not seeing call to queryRemove/stop.
But then why WdfFltrEvtDeviceSurpriseRemoval is called before WdfFltrEvtDeviceSelfManagedIoSuspend? Is it not possible for KMDF filter to access the volume before it goes offline.
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Doron,
disk or partition pnp stacks to see what is going on there might lead you the answer as to why the > volume is being surprise removed.
Do you mean to look for open handle or something like that? I’m looking for some pointer on this.
I read on another news group …
> > If the stack is PNP (and most are at the device level) the filter has to
be
> > PNP.
I’m thinking that may be my filter driver is creating a device which is not PNP and that is why I’m not getting any call before underlying volume device is removed. Any comments.
You have a pnp device, your extra control device is not important. My suggestion is to filter these other pnp stacks to see what is going on there
d
debt from my phone
From: xxxxx@hotmail.com
Sent: 4/24/2012 11:50 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting volume going offline in cluster
Doron,
disk or partition pnp stacks to see what is going on there might lead you the answer as to why the > volume is being surprise removed.
Do you mean to look for open handle or something like that? I’m looking for some pointer on this.
I read on another news group …
> > If the stack is PNP (and most are at the device level) the filter has to
be
> > PNP.
I’m thinking that may be my filter driver is creating a device which is not PNP and that is why I’m not getting any call before underlying volume device is removed. Any comments.
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Is there any thing I can read about filtering other PNP stack. I’m not sure I understand that. You mean to use windbg for that.
I’m seeing same behavior on standalonde windows server (2008 r2). When I offline the disk (containing only one volume) throuhg disk manager, I got the same sequence of call back in my driver – surprise removal before self manage IO suspend. However I see many IOCTLs coming down before that happens (in ioQueueConfig.EvtIoDeviceControl handler). I see only few IOCTLS when I take clustered disk offline in MSCS.
Taking disk offline shouldn’t be a surprised removal?
I don’t know. I gave you the same answer 5 times. Do you think asking again will give you a different answer that you like better?
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Tuesday, April 24, 2012 3:43 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Detecting volume going offline in cluster
Is there any thing I can read about filtering other PNP stack. I’m not sure I understand that. You mean to use windbg for that.
I’m seeing same behavior on standalonde windows server (2008 r2). When I offline the disk (containing only one volume) throuhg disk manager, I got the same sequence of call back in my driver – surprise removal before self manage IO suspend. However I see many IOCTLs coming down before that happens (in ioQueueConfig.EvtIoDeviceControl handler). I see only few IOCTLS when I take clustered disk offline in MSCS.
Taking disk offline shouldn’t be a surprised removal?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Thanks Doron for your help. I’ll read more about storaget stack (tree) and hopefully would be able to understand the problem better.
I’ve made lots of progress in my driver but unfortunately I’ve not been able to resolve my issue. What I was trying to understand is if my device is getting surprise remove from some other device(?). I’ve not found answer to that.
Here is how my device stack looks like. My driver is wdffltr.
0: kd> !devobj \Device\HarddiskVolume3
Device object (fffffa800357fcd0) is for:
HarddiskVolume3 \Driver\volmgr DriverObject fffffa8003395de0
Current Irp 00000000 RefCount 25 Type 00000007 Flags 00003050
Vpb fffffa8003575ea0 Dacl fffff9a1002dc320 DevExt fffffa800357fe20 DevObjExt fffffa800357ff88 Dope fffffa800357fc10 DevNode fffffa8003580b10
ExtensionFlags (0x00000800)
Unknown flags 0x00000800
AttachedDevice (Upper) fffffa8003680040 \Driver\volsnap
Device queue is not busy.
0: kd> !devstack fffffa800357fcd0
!DevObj !DrvObj !DevExt ObjectName
fffffa8003582950 \Driver\wdffltr fffffa8003582ec0
fffffa8003680040 \Driver\volsnap fffffa8003680190
fffffa800357fcd0 \Driver\volmgr fffffa800357fe20 HarddiskVolume3
!DevNode fffffa8003580b10 :
DeviceInst is “STORAGE\Volume{c2fa4078-9d1e-11e0-bdcc-806e6f6e6963}#0000000000100000”
ServiceName is “volsnap”
The article, http://www.wd-3.com/031504/AboutRemovalRelations.htm, from Mark Roddy, suggests something which I think I’m not addressing in my driver - Device relations. The MSDN states in the article http://msdn.microsoft.com/en-us/library/windows/hardware/ff551670(v=vs.85).aspx that “Function and filter drivers might handle RemovalRelations requests.” Are there any guidelines how KMDF filter driver would handle EvtDeviceRelationsQuery/IRP_MN_QUERY_DEVICE_RELATIONS
Would appreciate any help on this. Thanks.