How to know if IO is initiated by driver.

Hi,

I am writing a sample volume filter driver. I am doing a File IO from this
driver (I know this is not proper and causes layer violation). Since this IO
(IRP) is issued to a File, and NTFS gives it (IRP) again to my driver, is
there a way to know if this IO was initiated by my driver. I may issue 4MB
of File IO and NTFS may split the IO into multiple IRPs.

Thanks,
Sunil

*AssociatedIrp.MasterIrp could work if NTFS does the association this way.*

Besides this, I don’t think there would be a foolproof way to achieve what
you want to achieve here.

If you are looking for IOs on your own reserved file, then checking for
offsets on volume will work.

-Deepak

On Fri, Jun 3, 2011 at 11:49 AM, Sunil Patil wrote:

> Hi,
>
> I am writing a sample volume filter driver. I am doing a File IO from this
> driver (I know this is not proper and causes layer violation). Since this IO
> (IRP) is issued to a File, and NTFS gives it (IRP) again to my driver, is
> there a way to know if this IO was initiated by my driver. I may issue 4MB
> of File IO and NTFS may split the IO into multiple IRPs.
>
> Thanks,
> Sunil
> — NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
> other seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer