Determining where an IRP came from

NTDEV
1

Greetings all,

I have the beginnings of a volume manager… it’s currently implemented as
a legacy filter driver.

The driver currently attaches to the io stacks of the disk devices in
order to do I/O to them. The driver also exports a virtual disk
interface via a symlink to it’s device object.

Question: Since ALL I/O to the disks will pass through my driver, I need
to identify which one’s come in via my virtual device versus which ones
come in via applications that do I/O to the disks directly… What’s the
best way to do this?

Thanks in advance,
-bob

2

Do this by analyzing your device extension. It can either have a virtual
method table for IRP dispatch, or a signature the “device kind”.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Wednesday, November 30, 2005 7:13 PM
Subject: [ntdev] Determining where an IRP came from

Greetings all,

I have the beginnings of a volume manager… it’s currently implemented as
a legacy filter driver.

The driver currently attaches to the io stacks of the disk devices in
order to do I/O to them. The driver also exports a virtual disk
interface via a symlink to it’s device object.

Question: Since ALL I/O to the disks will pass through my driver, I need
to identify which one’s come in via my virtual device versus which ones
come in via applications that do I/O to the disks directly… What’s the
best way to do this?

Thanks in advance,
-bob

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Excuse the previous post with the bogus Subject…

Hi Maxim,

Sorry for being dense, but I don’t understand…

In my IRP read/write function, how can I tell where the IRP came from
using the device extension? I assumed that there would be some clue in
the IRP or stack location(s)… I need to decide whether or not to
process the IRP against the logical volume or simply pass it down to the
disk unaltered…

Thanks,
-bob

Maxim S. Shatskih wrote:

> Do this by analyzing your device extension. It can either have a
virtual
>method table for IRP dispatch, or a signature the “device kind”.
>
>Maxim Shatskih, Windows DDK MVP
>StorageCraft Corporation
>xxxxx@storagecraft.com
>http://www.storagecraft.com
>
>----- Original Message -----
>From:
>>To: “Windows System Software Devs Interest List”
>>Sent: Wednesday, November 30, 2005 7:13 PM
>>Subject: [ntdev] Determining where an IRP came from
>>
>>
>>Greetings all,
>>
>>I have the beginnings of a volume manager… it’s currently implemented as
>>a legacy filter driver.
>>
>>The driver currently attaches to the io stacks of the disk devices in
>>order to do I/O to them. The driver also exports a virtual disk
>>interface via a symlink to it’s device object.
>>
>>Question: Since ALL I/O to the disks will pass through my driver, I need
>>to identify which one’s come in via my virtual device versus which ones
>>come in via applications that do I/O to the disks directly… What’s the
>>best way to do this?
>>
>>Thanks in advance,
>>-bob
>>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com