Disabling a device from kernel mode

NTDEV
1

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

2

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I
don't like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id (5&29c7aec0&0&1) from the registry key and retrieve the device id
with IRP_MN_QUERY_ID? Is there a better way to get the device instance
id? Maybe there is some other parameter that I can send from kernel mode
to user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

But suppose I'm writing a filter driver that disables the device it filters
if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that this
device should be disabled, but all the filter has is the PDO for the
device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I
don't like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id (5&29c7aec0&0&1) from the registry key and retrieve the device id
with IRP_MN_QUERY_ID? Is there a better way to get the device instance
id? Maybe there is some other parameter that I can send from kernel mode
to user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Well then you have added a new functional requirement on top of the original
requirement that appeared to be: install/uninstall your filter driver. Your
new requirement is: manage the operational state of the filtered device from
your filter driver. That is a different beast entirely, and has little if
anything to do with the install/uninstall function. If you think the device
is broken, just tell PnP its broken. If you want the device to 'disappear'
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I'm writing a filter driver that disables the device it filters
if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that this
device should be disabled, but all the filter has is the PDO for the
device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you want to
attach to in kernel mode, you can figure this out from your installer as
well. I would recommend doing all of this in user mode w/documented
functions.

The value named SymbolicLink is placed there by the USB core stack, not the
pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.
The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I don't
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).
So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

5

You are right, I am talking about a very different functionality which has
nothing to do with the previous questions about install/uninstall.
I am now talking about a completely different driver that has nothing to do
with the previous driver that was discussed.

Although the filter driver got to the conclusion that the device should be
removed, the state of the device is not harmful and so I don't want to make
the device 'disappear' or to report that it is broken since this will
trigger a surprise removal from the PNP manager which might lead to lose of
information in the device.

Instead I want to get the device removed gracefully by disabling it or
removing it from a user mode process. Can you think of a way I can tell the
user mode process what device to disable when all I have is a PDO and the
user mode process needs a device instance id?

Is it legal to extract the device instance id from the
PLUGPLAY_REGKEY_DEVICE name that I got from ObQueryNameString after I opened
it using IoOpenDeviceRegistryKey?

Thanks,
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, August 24, 2004 10:20 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Well then you have added a new functional requirement on top of the original
requirement that appeared to be: install/uninstall your filter driver. Your
new requirement is: manage the operational state of the filtered device from
your filter driver. That is a different beast entirely, and has little if
anything to do with the install/uninstall function. If you think the device
is broken, just tell PnP its broken. If you want the device to 'disappear'
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I'm writing a filter driver that disables the device it filters
if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that this
device should be disabled, but all the filter has is the PDO for the
device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you want to
attach to in kernel mode, you can figure this out from your installer as
well. I would recommend doing all of this in user mode w/documented
functions.

The value named SymbolicLink is placed there by the USB core stack, not the
pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.
The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I don't
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).
So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

It's not legal to extract the name from the path that the kernel happens
to use to keep your device's instance data. Tomorrow that path might
have a different name and your customers would be screwed.

Sorry that this doesn't solve your problem, but a bad solution is
usually worse than no solution.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 2:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

You are right, I am talking about a very different functionality which
has nothing to do with the previous questions about install/uninstall.
I am now talking about a completely different driver that has nothing to
do with the previous driver that was discussed.

Although the filter driver got to the conclusion that the device should
be removed, the state of the device is not harmful and so I don't want
to make the device 'disappear' or to report that it is broken since this
will trigger a surprise removal from the PNP manager which might lead to
lose of information in the device.

Instead I want to get the device removed gracefully by disabling it or
removing it from a user mode process. Can you think of a way I can tell
the user mode process what device to disable when all I have is a PDO
and the user mode process needs a device instance id?

Is it legal to extract the device instance id from the
PLUGPLAY_REGKEY_DEVICE name that I got from ObQueryNameString after I
opened it using IoOpenDeviceRegistryKey?

Thanks,
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, August 24, 2004 10:20 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Well then you have added a new functional requirement on top of the
original requirement that appeared to be: install/uninstall your filter
driver. Your new requirement is: manage the operational state of the
filtered device from your filter driver. That is a different beast
entirely, and has little if anything to do with the install/uninstall
function. If you think the device is broken, just tell PnP its broken.
If you want the device to 'disappear'
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I'm writing a filter driver that disables the device it
filters if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that
this device should be disabled, but all the filter has is the PDO for
the device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I
don't like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id?
Maybe there is some other parameter that I can send from kernel mode to
user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

I understand. Thank you.
Can you think of another solution?

Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Wieland
Sent: Tuesday, August 24, 2004 11:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It's not legal to extract the name from the path that the kernel happens
to use to keep your device's instance data. Tomorrow that path might
have a different name and your customers would be screwed.

Sorry that this doesn't solve your problem, but a bad solution is
usually worse than no solution.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 2:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

You are right, I am talking about a very different functionality which
has nothing to do with the previous questions about install/uninstall.
I am now talking about a completely different driver that has nothing to
do with the previous driver that was discussed.

Although the filter driver got to the conclusion that the device should
be removed, the state of the device is not harmful and so I don't want
to make the device 'disappear' or to report that it is broken since this
will trigger a surprise removal from the PNP manager which might lead to
lose of information in the device.

Instead I want to get the device removed gracefully by disabling it or
removing it from a user mode process. Can you think of a way I can tell
the user mode process what device to disable when all I have is a PDO
and the user mode process needs a device instance id?

Is it legal to extract the device instance id from the
PLUGPLAY_REGKEY_DEVICE name that I got from ObQueryNameString after I
opened it using IoOpenDeviceRegistryKey?

Thanks,
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, August 24, 2004 10:20 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Well then you have added a new functional requirement on top of the
original requirement that appeared to be: install/uninstall your filter
driver. Your new requirement is: manage the operational state of the
filtered device from your filter driver. That is a different beast
entirely, and has little if anything to do with the install/uninstall
function. If you think the device is broken, just tell PnP its broken.
If you want the device to 'disappear'
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I'm writing a filter driver that disables the device it
filters if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that
this device should be disabled, but all the filter has is the PDO for
the device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I
don't like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id?
Maybe there is some other parameter that I can send from kernel mode to
user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get
the DEVINST/instance path when finding the interface.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 3:21 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

I understand. Thank you.
Can you think of another solution?

Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Wieland
Sent: Tuesday, August 24, 2004 11:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It's not legal to extract the name from the path that the kernel happens
to use to keep your device's instance data. Tomorrow that path might
have a different name and your customers would be screwed.

Sorry that this doesn't solve your problem, but a bad solution is
usually worse than no solution.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 2:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

You are right, I am talking about a very different functionality which
has nothing to do with the previous questions about install/uninstall.
I am now talking about a completely different driver that has nothing to
do with the previous driver that was discussed.

Although the filter driver got to the conclusion that the device should
be removed, the state of the device is not harmful and so I don't want
to make the device 'disappear' or to report that it is broken since this
will trigger a surprise removal from the PNP manager which might lead to
lose of information in the device.

Instead I want to get the device removed gracefully by disabling it or
removing it from a user mode process. Can you think of a way I can tell
the user mode process what device to disable when all I have is a PDO
and the user mode process needs a device instance id?

Is it legal to extract the device instance id from the
PLUGPLAY_REGKEY_DEVICE name that I got from ObQueryNameString after I
opened it using IoOpenDeviceRegistryKey?

Thanks,
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, August 24, 2004 10:20 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Well then you have added a new functional requirement on top of the
original requirement that appeared to be: install/uninstall your filter
driver. Your new requirement is: manage the operational state of the
filtered device from your filter driver. That is a different beast
entirely, and has little if anything to do with the install/uninstall
function. If you think the device is broken, just tell PnP its broken.
If you want the device to 'disappear'
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I'm writing a filter driver that disables the device it
filters if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that
this device should be disabled, but all the filter has is the PDO for
the device...
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is "device id\instance id".
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it's reliable). The only thing I
don't like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id?
Maybe there is some other parameter that I can send from kernel mode to
user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
''
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

9

I am sorry but I did not understand your suggestion.
Can you explain it more throughly ?

Thank you
Shahar

-----Original Message-----
“Doron Holan” wrote in message
news:xxxxx@ntdev…
Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get
the DEVINST/instance path when finding the interface.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 3:21 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

I understand. Thank you.
Can you think of another solution?

Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Wieland
Sent: Tuesday, August 24, 2004 11:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It’s not legal to extract the name from the path that the kernel happens
to use to keep your device’s instance data. Tomorrow that path might
have a different name and your customers would be screwed.

Sorry that this doesn’t solve your problem, but a bad solution is
usually worse than no solution.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 2:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

You are right, I am talking about a very different functionality which
has nothing to do with the previous questions about install/uninstall.
I am now talking about a completely different driver that has nothing to
do with the previous driver that was discussed.

Although the filter driver got to the conclusion that the device should
be removed, the state of the device is not harmful and so I don’t want
to make the device ‘disappear’ or to report that it is broken since this
will trigger a surprise removal from the PNP manager which might lead to
lose of information in the device.

Instead I want to get the device removed gracefully by disabling it or
removing it from a user mode process. Can you think of a way I can tell
the user mode process what device to disable when all I have is a PDO
and the user mode process needs a device instance id?

Is it legal to extract the device instance id from the
PLUGPLAY_REGKEY_DEVICE name that I got from ObQueryNameString after I
opened it using IoOpenDeviceRegistryKey?

Thanks,
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Tuesday, August 24, 2004 10:20 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Well then you have added a new functional requirement on top of the
original requirement that appeared to be: install/uninstall your filter
driver. Your new requirement is: manage the operational state of the
filtered device from your filter driver. That is a different beast
entirely, and has little if anything to do with the install/uninstall
function. If you think the device is broken, just tell PnP its broken.
If you want the device to ‘disappear’
then you need to consider bus driver functionality.

=====================
Mark Roddy

-----Original Message-----
From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Tuesday, August 24, 2004 5:03 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

But suppose I’m writing a filter driver that disables the device it
filters if that device made some kind of illegal operation.
In this case the filter will need to inform the user mode service that
this device should be disabled, but all the filter has is the PDO for
the device…
How do you suggest getting the device disabled in this case?

Thanks
Shahar

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Tuesday, August 24, 2004 9:42 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

It is by design that you cannot get the complete instance ID from kernel
mode. There is no need for it. If you can figure out which PDO you
want to attach to in kernel mode, you can figure this out from your
installer as well. I would recommend doing all of this in user mode
w/documented functions.

The value named SymbolicLink is placed there by the USB core stack, not
the pnp manager. As such, it is only present on usb enumerated devices.
This string is the device interface string that you can get in user
mode.

d

________________________________________
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Tuesday, August 24, 2004 11:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Disabling a device from kernel mode

Hi,
A couple of days ago I posted a question about disabling devices from a
device driver.
I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get
some other device disabled.
The function I figured that can do this is
SetupDiSetClassInstallParams(), but in order to call this function I
need the Device Instance ID, which I could not find a way to retrieve in
kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.
I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.
The problem is that if the bus does not have UniqueID capability then
the BusQueryInstanceID is only part of the instance id, and the rest of
it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy
with the same problem.
He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5
&29c7aec0&0&1\Device Parameters
The bold part in the key name is the device instance id, so after he
opened the key he used ObQueryNameString to get the full name for the
key and extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I
don’t like is that ObQueryNameString is not documented in the DDK (only
in the IFS).
So here is a newbie question: I do I include ntifs.h in my project when
I already include wdm.h without getting a lot of multiple definition
errors?

And some more questions:
Is this an acceptable solution for getting the device instance id? Will
I always get the right id? Will it be better to only take the instance
id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id?
Maybe there is some other parameter that I can send from kernel mode to
user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):
??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04f
b951ed}
Now, I guess that this symbolic link is created by the PnP manager. Is
it created for every device? Is it always created in this format? Is it
legal / reliable to extract the device instance id from this string? Is
there some API (kernel or user) I can use to get the device instance id
using the symbolic name? Can the user-mode program use this symbolic
name to disable the device instead of using the device instance id?

Thanks,
Shahar
—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

10

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Shahar Talmi
To: Windows System Software Devs Interest List
Sent: Tuesday, August 24, 2004 10:56 PM
Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a device driver.

I now understand that the only way to do this is from user mode, so I decided to send notify a user mode service when my driver needs to get some other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(), but in order to call this function I need the Device Instance ID, which I could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the BusQueryInstanceID is only part of the instance id, and the rest of it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV (http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened the key he used ObQueryNameString to get the full name for the key and extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t like is that ObQueryNameString is not documented in the DDK (only in the IFS).

So here is a newbie question: I do I include ntifs.h in my project when I already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I always get the right id? Will it be better to only take the instance id (5&29c7aec0&0&1) from the registry key and retrieve the device id with IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe there is some other parameter that I can send from kernel mode to user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it created for every device? Is it always created in this format? Is it legal / reliable to extract the device instance id from this string? Is there some API (kernel or user) I can use to get the device instance id using the symbolic name? Can the user-mode program use this symbolic name to disable the device instead of using the device instance id?

Thanks,

Shahar

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>

12

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System mailto:xxxxx Software Devs Interest List

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>

13

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying.

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

Thanks

Shahar Talmi

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>

14

Can you run these disables from user mode?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Shahar Talmi
To: Windows System Software Devs Interest List
Sent: Wednesday, August 25, 2004 5:22 PM
Subject: RE: [ntdev] Disabling a device from kernel mode

Failing the IRP’s will not stop the device from functioning since other device stacks might still be controlling it using a direct call interface it previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I am working on 2K/XP - query-stop/stop is not relevant) as they see fit. Still, this is the best way I can think of to disable the device with minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing different from the user stopping the device using the “Safely Remove Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a solution for me, but I couldn’t understand what exactly he was saying.

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By getting the device interface to your device, the user mode app can get the DEVINST/instance path when finding the interface.

d

Thanks

Shahar Talmi

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress requests will complete normally.Note that the semantics of query-remove/remove and query-stop/stop state transitions do NOT require the device to complete in progress requests normally, they are free to fail them as they see fit. PnP enable/disable start/stop might seem to you to be the right way to go, but I think you are trying to force a hardware enumeration/resource rebalancing system to do something it was not designed to do.

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi

To: Windows System Software Devs Interest List

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a device driver.

I now understand that the only way to do this is from user mode, so I decided to send notify a user mode service when my driver needs to get some other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(), but in order to call this function I need the Device Instance ID, which I could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the BusQueryInstanceID is only part of the instance id, and the rest of it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV (http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened the key he used ObQueryNameString to get the full name for the key and extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t like is that ObQueryNameString is not documented in the DDK (only in the IFS).

So here is a newbie question: I do I include ntifs.h in my project when I already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I always get the right id? Will it be better to only take the instance id (5&29c7aec0&0&1) from the registry key and retrieve the device id with IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe there is some other parameter that I can send from kernel mode to user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it created for every device? Is it always created in this format? Is it legal / reliable to extract the device instance id from this string? Is there some API (kernel or user) I can use to get the device instance id using the symbolic name? Can the user-mode program use this symbolic name to disable the device instead of using the device instance id?

Thanks,

Shahar

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

15

What do you mean?

In user mode I can disable a device by calling SetupDiSetClassInstallParams.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 2:41 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Can you run these disables from user mode?

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Wednesday, August 25, 2004 5:22 PM

Subject: RE: [ntdev] Disabling a device from kernel mode

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying.

--------------------------

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

--------------------------

Thanks

Shahar Talmi



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

_____

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx></mailto:xxxxx></mailto:xxxxx>

16

Eh? Sure there could be a non-IRP-based data path, in theory. Did you have a
real world example in mind, or is this all theoretical?

=====================
Mark Roddy

From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Wednesday, August 25, 2004 9:23 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying…

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

Thanks

Shahar Talmi

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com mailto:xxxxx
http://www.storagecraft.com http:

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System mailto:xxxxx Software Devs Interest List

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html
http: ) of a guy
with the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></mailto:xxxxx></mailto:xxxxx></http:></mailto:xxxxx>

17

My driver filters many kinds of devices and I cannot make any assumptions
about the way they are functioning.

Direct-call interfaces are a completely legal and documented mechanism and
there are many others like it.

I cannot ignore the fact that theoretically a device might still be
functioning although I fail its IRPs.

The only way I can think about is disabling it from user mode (in case the
disabling fails in user mode I plan to trigger a surprise removal, but this
is only the last resort).

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Wednesday, August 25, 2004 3:04 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Eh? Sure there could be a non-IRP-based data path, in theory. Did you have a
real world example in mind, or is this all theoretical?

=====================
Mark Roddy

From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Wednesday, August 25, 2004 9:23 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying…

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

Thanks

Shahar Talmi

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com —
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>

18

Well then you need to go study the approach Doron suggested, using a Pnp
enumerable device interface to identify your filtered objects. I don’t think
you are going to easily get the sort of controlled quiesence that you appear
to be trying to achieve, but that is your design challenge.

=====================
Mark Roddy

From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Wednesday, August 25, 2004 10:16 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

My driver filters many kinds of devices and I cannot make any assumptions
about the way they are functioning.

Direct-call interfaces are a completely legal and documented mechanism and
there are many others like it.

I cannot ignore the fact that theoretically a device might still be
functioning although I fail its IRPs.

The only way I can think about is disabling it from user mode (in case the
disabling fails in user mode I plan to trigger a surprise removal, but this
is only the last resort).

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Roddy, Mark
Sent: Wednesday, August 25, 2004 3:04 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Eh? Sure there could be a non-IRP-based data path, in theory. Did you have a
real world example in mind, or is this all theoretical?

=====================
Mark Roddy

From: Shahar Talmi [mailto:xxxxx@safend.com]
Sent: Wednesday, August 25, 2004 9:23 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying…

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

Thanks

Shahar Talmi

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com mailto:xxxxx
http://www.storagecraft.com http:

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System mailto:xxxxx Software Devs Interest List

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html
http: ) of a guy
with the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com —
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@safend.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</http:></mailto:xxxxx></mailto:xxxxx></http:></mailto:xxxxx>

19

Simple, your driver registers a device interface using a GUID. Your app uses the same GUID to acquire a handle to the that device interface. You can also use the GUID to acquire the instance. If you had spent a few minutes with a compiler and debugger you could have answered your own question.

–
The personal opinion of
Gary G. Little
“Shahar Talmi” wrote in message news:xxxxx@ntdev…
Failing the IRP’s will not stop the device from functioning since other device stacks might still be controlling it using a direct call interface it previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I am working on 2K/XP - query-stop/stop is not relevant) as they see fit. Still, this is the best way I can think of to disable the device with minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing different from the user stopping the device using the “Safely Remove Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a solution for me, but I couldn’t understand what exactly he was saying.

--------------------------

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By getting the device interface to your device, the user mode app can get the DEVINST/instance path when finding the interface.

d

--------------------------

Thanks

Shahar Talmi

------------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress requests will complete normally.Note that the semantics of query-remove/remove and query-stop/stop state transitions do NOT require the device to complete in progress requests normally, they are free to fail them as they see fit. PnP enable/disable start/stop might seem to you to be the right way to go, but I think you are trying to force a hardware enumeration/resource rebalancing system to do something it was not designed to do.

----------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device and might cause loss of information.

I want to disable the device gracefully.

Shahar

----------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi

To: Windows System Software Devs Interest List

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a device driver.

I now understand that the only way to do this is from user mode, so I decided to send notify a user mode service when my driver needs to get some other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(), but in order to call this function I need the Device Instance ID, which I could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the BusQueryInstanceID is only part of the instance id, and the rest of it is defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV (http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened the key he used ObQueryNameString to get the full name for the key and extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t like is that ObQueryNameString is not documented in the DDK (only in the IFS).

So here is a newbie question: I do I include ntifs.h in my project when I already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I always get the right id? Will it be better to only take the instance id (5&29c7aec0&0&1) from the registry key and retrieve the device id with IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe there is some other parameter that I can send from kernel mode to user mode that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it created for every device? Is it always created in this format? Is it legal / reliable to extract the device instance id from this string? Is there some API (kernel or user) I can use to get the device instance id using the symbolic name? Can the user-mode program use this symbolic name to disable the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

20

I was just done implementing this but I have a little problem:

In each of my filter device I register a device interface using a GUID I
defined and when I want the user mode service to remove my device I send the
interface name I got from IoRegisterDeviceInterface.

When the user mode service receives the interface name it enumerates all the
interfaces with the same class GUID I defined and if the name it received
from kernel mode is identical to the name it obtains from
SetupDiGetInterfaceDetail it removes the device.

The problem is that the string returned by IoRegisterDeviceInterface is of
the form:

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{900e6dac-730d-48d9-93a7-54f33C5aac
5b}

But the string returned by SetupDiGetDeviceInterfaceDetail is of the form:

\?\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{900e6dac-730d-48d9-93a7-54f33C5aac
5b}

(The first starts with ??\ and the second with \?)

Can anyone explain the meaning of the difference? Is it legal to ignore the
first characters of the interface name when comparing?

For the record, I was not lazy in testing the method Doron suggested, It
just took time for me to understand what he was saying.

Thanks

Shahar

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Gary G. Little
Sent: Wednesday, August 25, 2004 3:29 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Disabling a device from kernel mode

Simple, your driver registers a device interface using a GUID. Your app uses
the same GUID to acquire a handle to the that device interface. You can also
use the GUID to acquire the instance. If you had spent a few minutes with a
compiler and debugger you could have answered your own question.

–
The personal opinion of
Gary G. Little

“Shahar Talmi” wrote in message news:xxxxx@ntdev…

Failing the IRP’s will not stop the device from functioning since other
device stacks might still be controlling it using a direct call interface it
previously got using IRP_MN_QUERY_ INTERFACE or some other non-IRP based
communication mechanism.

I realize that every driver is free to implement the query-remove/remove (I
am working on 2K/XP - query-stop/stop is not relevant) as they see fit.
Still, this is the best way I can think of to disable the device with
minimum loss of data.

Why do you say the system was not designed for that? How is what I’m doing
different from the user stopping the device using the “Safely Remove
Hardware” dialog?

Can someone please explain Doron’s suggestion? It seems like he has a
solution for me, but I couldn’t understand what exactly he was saying.

--------------------------

Doron Holan wrote:

Have your app open a handle to your driver using a device interface. By
getting the device interface to your device, the user mode app can get the
DEVINST/instance path when finding the interface.

d

--------------------------

Thanks

Shahar Talmi



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, August 25, 2004 1:47 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

So just start failing new requests in your filter driver. In progress
requests will complete normally.Note that the semantics of
query-remove/remove and query-stop/stop state transitions do NOT require the
device to complete in progress requests normally, they are free to fail them
as they see fit. PnP enable/disable start/stop might seem to you to be the
right way to go, but I think you are trying to force a hardware
enumeration/resource rebalancing system to do something it was not designed
to do.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shahar Talmi
Sent: Wednesday, August 25, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Disabling a device from kernel mode

The devnode I’m trying to disable is my own. I am a filter in this devnode.

The suicide method you suggest is too brutal for me since failing
IRP_MN_QUERY_DEVICE_PNP_STATE will trigger a surprise removal of the device
and might cause loss of information.

I want to disable the device gracefully.

Shahar

_____

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, August 25, 2004 12:45 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Disabling a device from kernel mode

Why you ever need to touch the devnodes other then your own?

If you just want to “commit suicide” by disabling your own devnode - use
IoInvalidateDeviceState.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----

From: Shahar Talmi mailto:xxxxx

To: Windows System Software Devs Interest List mailto:xxxxx

Sent: Tuesday, August 24, 2004 10:56 PM

Subject: [ntdev] Disabling a device from kernel mode

Hi,

A couple of days ago I posted a question about disabling devices from a
device driver.

I now understand that the only way to do this is from user mode, so I
decided to send notify a user mode service when my driver needs to get some
other device disabled.

The function I figured that can do this is SetupDiSetClassInstallParams(),
but in order to call this function I need the Device Instance ID, which I
could not find a way to retrieve in kernel mode using a PDO.

To my understanding the device instance id is “device id\instance id”.

I can get both of these IDs from the PDO by sending it a IRP_MN_QUERY_ID
with BusQueryDeviceID and BusQueryInstanceID respectively.

The problem is that if the bus does not have UniqueID capability then the
BusQueryInstanceID is only part of the instance id, and the rest of it is
defined by the PnP manager, which I did not find anyway to query.

I found some old thread in NTDEV
(http://www.osronline.com/lists_archive/ntdev/thread369.html) of a guy with
the same problem.

He used IoOpenDeviceRegistryKey with PLUGPLAY_REGKEY_DEVICE to open the
hardware key for the device which is (for example):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_03eb&Pid_7605\5&29c
7aec0&0&1\Device Parameters

The bold part in the key name is the device instance id, so after he opened
the key he used ObQueryNameString to get the full name for the key and
extracted the parent keys name.

This sounds like a good solution (if it’s reliable). The only thing I don’t
like is that ObQueryNameString is not documented in the DDK (only in the
IFS).

So here is a newbie question: I do I include ntifs.h in my project when I
already include wdm.h without getting a lot of multiple definition errors?

And some more questions:

Is this an acceptable solution for getting the device instance id? Will I
always get the right id? Will it be better to only take the instance id
(5&29c7aec0&0&1) from the registry key and retrieve the device id with
IRP_MN_QUERY_ID? Is there a better way to get the device instance id? Maybe
there is some other parameter that I can send from kernel mode to user mode
that will be sufficient for disabling the device?

I noticed that in the Device Parameters key that IoOpenDeviceRegistryKey
opens there is a key named SymbolicName with the value (for example):

??\USB#Vid_03eb&Pid_7605#5&29c7aec0&0&1#{a5dcbf10-6530-11d2-901f-00c04fb951
ed}

Now, I guess that this symbolic link is created by the PnP manager. Is it
created for every device? Is it always created in this format? Is it legal /
reliable to extract the device instance id from this string? Is there some
API (kernel or user) I can use to get the device instance id using the
symbolic name? Can the user-mode program use this symbolic name to disable
the device instead of using the device instance id?

Thanks,

Shahar

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>