Issue with my disk filter driver

NTDEV
1

I have a driver that registers an EventCategoryDeviceInterfaceChange callback with IoRegisterPlugPlayNotification() for GUID_DEVINTERFACE_DISK devices.

Upon receiving a GUID_DEVICE_INTERFACE_ARRIVAL event, it attaches itself to the arrived device using IoAttachDeviceToDeviceStackSafe.

Apart from displaying some debugging information, the driver passes ALL IRP_MJ_XXX and FastIoXXX calls down the next driver using IoSkipCurrentStackLocation -> IoCallDriver.

Device Manager is displaying the disk device and the Device Stack property (in the details page) is showing…

\Driver\myfilt
\Driver\partmgr
\Driver\disk
\Driver\mystorp

My issue is that the disk is not showing in either Disk Management or DiskPart but the buffer returned from IOCTL_DISK_GET_DISK_LAYOUT_EX (or similar) contains valid information read from the disk.

Has anyone got an idea what would be causing this?

Thanks,
Jamie

2

Attaching to an already built pnp stack is not a supported behavior

d

Bent from my phone

From: xxxxx@win32.f9.co.ukmailto:xxxxx
Sent: ?4/?4/?2014 8:03 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] Issue with my disk filter driver

I have a driver that registers an EventCategoryDeviceInterfaceChange callback with IoRegisterPlugPlayNotification() for GUID_DEVINTERFACE_DISK devices.

Upon receiving a GUID_DEVICE_INTERFACE_ARRIVAL event, it attaches itself to the arrived device using IoAttachDeviceToDeviceStackSafe.

Apart from displaying some debugging information, the driver passes ALL IRP_MJ_XXX and FastIoXXX calls down the next driver using IoSkipCurrentStackLocation -> IoCallDriver.

Device Manager is displaying the disk device and the Device Stack property (in the details page) is showing…

\Driver\myfilt
\Driver\partmgr
\Driver\disk
\Driver\mystorp

My issue is that the disk is not showing in either Disk Management or DiskPart but the buffer returned from IOCTL_DISK_GET_DISK_LAYOUT_EX (or similar) contains valid information read from the disk.

Has anyone got an idea what would be causing this?

Thanks,
Jamie

—
NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

3

The obvious simple question, is what is the DeviceType of the device you
attach to the disk? I’ve used the approach of changing the type to hide
drives for clients in the past. If the type is the same as the device you
are attaching to, then it is more complex and we will need more data.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@win32.f9.co.uk
Sent: Friday, April 04, 2014 11:03 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Issue with my disk filter driver

I have a driver that registers an EventCategoryDeviceInterfaceChange
callback with IoRegisterPlugPlayNotification() for GUID_DEVINTERFACE_DISK
devices.

Upon receiving a GUID_DEVICE_INTERFACE_ARRIVAL event, it attaches itself to
the arrived device using IoAttachDeviceToDeviceStackSafe.

Apart from displaying some debugging information, the driver passes ALL
IRP_MJ_XXX and FastIoXXX calls down the next driver using
IoSkipCurrentStackLocation -> IoCallDriver.

Device Manager is displaying the disk device and the Device Stack property
(in the details page) is showing…

\Driver\myfilt
\Driver\partmgr
\Driver\disk
\Driver\mystorp

My issue is that the disk is not showing in either Disk Management or
DiskPart but the buffer returned from IOCTL_DISK_GET_DISK_LAYOUT_EX (or
similar) contains valid information read from the disk.

Has anyone got an idea what would be causing this?

Thanks,
Jamie

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Thank you for your responses.

I am copying the DeviceType field from the DEVICE_OBJECT to which I am attaching. I don?t have access to my development machine at present, but if memory serves me correctly, this was showing as ?7? in WinDbg. I will check on Monday and force it to FILE_DEVICE_DISK.

My final goal is to hide the disks attached to my virtual StorPort/ScsiPort adapter, but allow IRP_MJ_READ and IRP_MJ_WRITE. Although I seem to have already achieved this (by complete accident), at present, I just want to dump the IRP?s to the debugger.

Doron - if my method is unsupported, please can you suggest what method should I use? Can I substitute my own class driver for StorPort devices?

Thanks,
Jamie

5

You make your driver a device class filter driver for all disks or a device
specific filter driver. You should take a look at the DiskPerf sample, this
shows how to attach, and a lot more information for a disk filter.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@win32.f9.co.uk
Sent: Saturday, April 05, 2014 3:51 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Issue with my disk filter driver

Thank you for your responses.

I am copying the DeviceType field from the DEVICE_OBJECT to which I am
attaching. I don?t have access to my development machine at present, but if
memory serves me correctly, this was showing as ?7? in WinDbg. I will check
on Monday and force it to FILE_DEVICE_DISK.

My final goal is to hide the disks attached to my virtual StorPort/ScsiPort
adapter, but allow IRP_MJ_READ and IRP_MJ_WRITE. Although I seem to have
already achieved this (by complete accident), at present, I just want to
dump the IRP?s to the debugger.

Doron - if my method is unsupported, please can you suggest what method
should I use? Can I substitute my own class driver for StorPort devices?

Thanks,
Jamie

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Thank you Don, I will look at Diskperf.

7

I looked at the MS Diskperf sample and from this, I have been able to implement a much cleaner solution to my original issue.

Thanks Don.