disk filter driver on win2k3

NTDEV
1

Hi,

I have a disk filter driver. On Win2k3 server noticed that while creating
“New Partition/Volume”, some of the WRITE IOs are not getting filtered (may
be not going through WRITE IO path). Problem seems to be with the WRITE IO
coming on first block (first 512 bytes starting from offset 0) on the disk
which contains I guess partition table/label. Other IOs are tracked
correctly. Any idea why this is so? This issue is not seen on win2k8.

Thanks,
Sunil

2

Correct, older Windows like XP did not allow the filter drivers to filter read/writes issued by IoRead/WritePartitionTable.

They are originated in disk.sys itself and are invisible to any party above disk.sys

With Vista+, it is PartMgr and not Disk who does IoRead/WritePartitionTable, so, these IRPs can be filtered between PartMgr and Disk.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

“Sunil Patil” wrote in message news:xxxxx@ntdev…
Hi,

I have a disk filter driver. On Win2k3 server noticed that while creating “New Partition/Volume”, some of the WRITE IOs are not getting filtered (may be not going through WRITE IO path). Problem seems to be with the WRITE IO coming on first block (first 512 bytes starting from offset 0) on the disk which contains I guess partition table/label. Other IOs are tracked correctly. Any idea why this is so? This issue is not seen on win2k8.

Thanks,
Sunil

3

You should install check version of claspnp.sys and partmgr.sys and attach WinDbg. Put breakpoint at partmgr!PmCreateDisk and CLASSPNP!ClassReadWrite and see if you could stop there. If you have an upper filter you should get a Write request between these two breakpoints. If you have a lower filter you could continue to debug after CLASSPNP!ClassReadWrite to see if the Write request reach your driver. It is not a solution to solve your problem but at least it may help to understand you what is wrong.

Igor Sharovar