IRP_MJ_FILE_SYSTEM_CONTROL vs. IRP_MJ_DEVICE_CONTROL

NTFSD
1

The WDK document does not clearly say which CTL_CODE should be filtered
under FILE_SYSTEM_CONTROL or DEVICE_CONTROL. Both of them can be initiated
by DeviceIoControl in User Mode.
Should it be filtered under IRP_MJ_FILE_SYSTEM_CONTROL only if the control
code is defined with FILE_DEVICE_FILE_SYSTEM? How to determine MinorFunction
if it is IRP_MJ_FILE_SYSTEM_CONTROL?

Thanks,
Shangwu

2

DEVICE_CONTROL’s in a file system context typically are for a file, while
FILE_SYSTEM_CONTROLS are for the file system. A simple rule of thumb is the
codes defined as FSCTL_XXX are going to FILE_SYSTEM_CONTROL’s. The way you
get the MinorFunction is the same for both types of requests.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Shangwu” wrote in message news:xxxxx@ntfsd…
> The WDK document does not clearly say which CTL_CODE should be filtered
> under FILE_SYSTEM_CONTROL or DEVICE_CONTROL. Both of them can be initiated
> by DeviceIoControl in User Mode.
> Should it be filtered under IRP_MJ_FILE_SYSTEM_CONTROL only if the control
> code is defined with FILE_DEVICE_FILE_SYSTEM? How to determine
> MinorFunction if it is IRP_MJ_FILE_SYSTEM_CONTROL?
>
> Thanks,
> Shangwu
>
>
>
>

3

Hi Shangwu,

If you are making a minifilter, then you might (depends on what your driver does) skip filtering IRP_MJ_FILE_SYSTEM_CONTROL.
Typically, FS filters filter this IRP to track the mounting of new volumes by monitoring the IRP_MN_MOUNT_VOLUME and then attach to this volume.

To determine the minor function in minifilter, just use the value callbackdata->Iopb->MinorFunction.

Regards,
Ayush Gupta

4

Thanks Don for your clarification. So FSCTL_SET_REPARSE_POINT should be
filtered under IRP_MJ_FILE_SYSTEM_CONTROL instead of …DEVICE_CONTROL. Is
this correct?

Shangwu

“Don Burn” wrote in message news:xxxxx@ntfsd…
> DEVICE_CONTROL’s in a file system context typically are for a file, while
> FILE_SYSTEM_CONTROLS are for the file system. A simple rule of thumb is
> the codes defined as FSCTL_XXX are going to FILE_SYSTEM_CONTROL’s. The
> way you get the MinorFunction is the same for both types of requests.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
> “Shangwu” wrote in message news:xxxxx@ntfsd…
>> The WDK document does not clearly say which CTL_CODE should be filtered
>> under FILE_SYSTEM_CONTROL or DEVICE_CONTROL. Both of them can be
>> initiated by DeviceIoControl in User Mode.
>> Should it be filtered under IRP_MJ_FILE_SYSTEM_CONTROL only if the
>> control code is defined with FILE_DEVICE_FILE_SYSTEM? How to determine
>> MinorFunction if it is IRP_MJ_FILE_SYSTEM_CONTROL?
>>
>> Thanks,
>> Shangwu
>>
>>
>>
>>
>
>
>

5

I searched the following description from MS.

Entry Points for IOCTLs/FSCTLs
In Windows NT 4.0, the following FSCTLs were delivered via
IRP_MJ_FILE_SYSTEM_CONTROL, and all others delivered via
IRP_MJ_DEVICE_CONTROL.

FSCTL_LOCK_VOLUME

FSCTL_UNLOCK_VOLUME

FSCTL_DISMOUNT_VOLUME

FSCTL_MOUNT_DBLS_VOLUME

FSCTL_GET_COMPRESSION

FSCTL_SET_COMPRESSION

FSCTL_READ_COMPRESSION

FSCTL_WRITE_COMPRESSION
In Windows 2000, this explicit list has been replaced by a more generalized
check to see ifdwIoControlCode >> 16 == FILE_DEVICE_FILE_SYSTEM.

Implementations that send private IOCTLs from user mode to their file
system drivers and expect to receive them in the IRP_MJ_DEVICE_CONTROL path
will be affected by this change, because these IOCTLs will now be delivered
via the IRP_MJ_FILE_SYSTEM_CONTROL path. A possible solution for drivers
that need to run on both Windows NT 4.0 and Windows 2000 is to case on the
IOCTL number in both paths and call a common routine.

“Shangwu” wrote in message news:xxxxx@ntfsd…
> Thanks Don for your clarification. So FSCTL_SET_REPARSE_POINT should be
> filtered under IRP_MJ_FILE_SYSTEM_CONTROL instead of …DEVICE_CONTROL. Is
> this correct?
>
> Shangwu
>
> “Don Burn” wrote in message news:xxxxx@ntfsd…
>> DEVICE_CONTROL’s in a file system context typically are for a file, while
>> FILE_SYSTEM_CONTROLS are for the file system. A simple rule of thumb is
>> the codes defined as FSCTL_XXX are going to FILE_SYSTEM_CONTROL’s. The
>> way you get the MinorFunction is the same for both types of requests.
>>
>>
>> –
>> Don Burn (MVP, Windows DDK)
>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> Website: http://www.windrvr.com
>> Blog: http://msmvps.com/blogs/WinDrvr
>> Remove StopSpam to reply
>>
>>
>> “Shangwu” wrote in message news:xxxxx@ntfsd…
>>> The WDK document does not clearly say which CTL_CODE should be filtered
>>> under FILE_SYSTEM_CONTROL or DEVICE_CONTROL. Both of them can be
>>> initiated by DeviceIoControl in User Mode.
>>> Should it be filtered under IRP_MJ_FILE_SYSTEM_CONTROL only if the
>>> control code is defined with FILE_DEVICE_FILE_SYSTEM? How to determine
>>> MinorFunction if it is IRP_MJ_FILE_SYSTEM_CONTROL?
>>>
>>> Thanks,
>>> Shangwu
>>>
>>>
>>>
>>>
>>
>>
>>
>
>
>