Issues with volume filter driver

Hi All,

I have written a simple volume filter driver that tries to attach to a hard coded volume
\device\Harddisk0\Partition3. This partition is non system/boot drive.I am attaching to the device in function DriverEntry.I have created following registry keys.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\voldrv Start = 0(boot time).
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{71A27CDD-812A-11D0-BEC7-08002BE2092F} UpperFilters=voldrv.
Code is written such that except create operation, all other requests are passed to lower driver.
I find that the OS does not load the driver at boot time.
Please help me solve this problem.

Code snipet from DriverEntry is like this:

VolumeDeviceObject = ExAllocatePool(NonPagedPool,sizeof(DEVICE_OBJECT));
if(VolumeDeviceObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}
//
// Create a filter device object for this device (partition).
//

DebugPrint((2, “VolDrvAddDevice: Driver %X Device %X\n”,
DriverObject, VolumeDeviceObject));

RtlInitUnicodeString(&volumeFilter, L"\Device\VolumeFilter" );
status = IoCreateDevice(DriverObject,
DEVICE_EXTENSION_SIZE,
&volumeFilter,
FILE_DEVICE_DISK,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&filterDeviceObject);

if (!NT_SUCCESS(status)) {
DebugPrint((1, “VolDrvAddDevice: Cannot create filterDeviceObject\n”));
return status;
}

filterDeviceObject->Flags |= DO_DIRECT_IO;

deviceExtension = (PDEVICE_EXTENSION) filterDeviceObject->DeviceExtension;

RtlZeroMemory(deviceExtension, DEVICE_EXTENSION_SIZE);

RtlInitUnicodeString( &deviceName,L"\Device\Harddisk0\Partition3");

deviceExtension->fileObject = ExAllocatePool(NonPagedPool,sizeof(FILE_OBJECT));

if(deviceExtension->fileObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}

// get pointer to target device object

status = IoGetDeviceObjectPointer( &deviceName,
FILE_READ_DATA,
&deviceExtension->fileObject,
&VolumeDeviceObject );

if( !NT_SUCCESS(status) )
{
DebugPrint((1,“IoGetDeviceObjectPointer failed with status %d\n”));
return status;
}

obj = IoAttachDeviceToDeviceStack( filterDeviceObject,
VolumeDeviceObject
);
if( obj == NULL )
{
DebugPrint((1,“IoAttachDeviceToDeviceStack failed\n”));

Thanks in advance.
Regards,
Ameet

There’s a number of things here. First, disks and volumes are loaded by
PnP, so there’s no guarantee the way you’ve architected this that they
will be loaded before your legacy type driver is loaded. Second, even if
the volume is there when your driver boots, you’ve no guarantee that
there hasn’t been some I/O already occurred on the volume. This solution
is a fail, no matter what you do with it.

Go look at the DiskPerf sample in the DDK, it is a disk filter but with
very minor modifications can be made in to a volume filter. This is a
PnP friendly filter driver with no drawbacks compared to what you have
now. Yes, the filter is loaded over every volume instance, but all you
have to do in AddDevice() is see if the new instance is for the volume
you’re interested in. If not, then for that instance just pass the IRPs
down stack without doing anything to them.

Mark.

On 01/09/2011 11:55, xxxxx@gmail.com wrote:

Hi All,

I have written a simple volume filter driver that tries to attach to a hard coded volume
\device\Harddisk0\Partition3. This partition is non system/boot drive.I am attaching to the device in function DriverEntry.I have created following registry keys.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\voldrv Start = 0(boot time).
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{71A27CDD-812A-11D0-BEC7-08002BE2092F} UpperFilters=voldrv.
Code is written such that except create operation, all other requests are passed to lower driver.
I find that the OS does not load the driver at boot time.
Please help me solve this problem.

Code snipet from DriverEntry is like this:

VolumeDeviceObject = ExAllocatePool(NonPagedPool,sizeof(DEVICE_OBJECT));
if(VolumeDeviceObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}
//
// Create a filter device object for this device (partition).
//

DebugPrint((2, “VolDrvAddDevice: Driver %X Device %X\n”,
DriverObject, VolumeDeviceObject));

RtlInitUnicodeString(&volumeFilter, L"\Device\VolumeFilter" );
status = IoCreateDevice(DriverObject,
DEVICE_EXTENSION_SIZE,
&volumeFilter,
FILE_DEVICE_DISK,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&filterDeviceObject);

if (!NT_SUCCESS(status)) {
DebugPrint((1, “VolDrvAddDevice: Cannot create filterDeviceObject\n”));
return status;
}

filterDeviceObject->Flags |= DO_DIRECT_IO;

deviceExtension = (PDEVICE_EXTENSION) filterDeviceObject->DeviceExtension;

RtlZeroMemory(deviceExtension, DEVICE_EXTENSION_SIZE);

RtlInitUnicodeString(&deviceName,L"\Device\Harddisk0\Partition3");

deviceExtension->fileObject = ExAllocatePool(NonPagedPool,sizeof(FILE_OBJECT));

if(deviceExtension->fileObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}

// get pointer to target device object

status = IoGetDeviceObjectPointer(&deviceName,
FILE_READ_DATA,
&deviceExtension->fileObject,
&VolumeDeviceObject );

if( !NT_SUCCESS(status) )
{
DebugPrint((1,“IoGetDeviceObjectPointer failed with status %d\n”));
return status;
}

obj = IoAttachDeviceToDeviceStack( filterDeviceObject,
VolumeDeviceObject
);
if( obj == NULL )
{
DebugPrint((1,“IoAttachDeviceToDeviceStack failed\n”));

Thanks in advance.
Regards,
Ameet

You cannot allocate a DEVICE_OBJECT or FILE_OBJECT this way. Only the io manager allocates these types of objecys

d

debt from my phone

-----Original Message-----
From: xxxxx@gmail.com
Sent: Thursday, September 01, 2011 3:56 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Issues with volume filter driver

Hi All,

I have written a simple volume filter driver that tries to attach to a hard coded volume
\device\Harddisk0\Partition3. This partition is non system/boot drive.I am attaching to the device in function DriverEntry.I have created following registry keys.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\voldrv Start = 0(boot time).
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{71A27CDD-812A-11D0-BEC7-08002BE2092F} UpperFilters=voldrv.
Code is written such that except create operation, all other requests are passed to lower driver.
I find that the OS does not load the driver at boot time.
Please help me solve this problem.

Code snipet from DriverEntry is like this:

VolumeDeviceObject = ExAllocatePool(NonPagedPool,sizeof(DEVICE_OBJECT));
if(VolumeDeviceObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}
//
// Create a filter device object for this device (partition).
//

DebugPrint((2, “VolDrvAddDevice: Driver %X Device %X\n”,
DriverObject, VolumeDeviceObject));

RtlInitUnicodeString(&volumeFilter, L"\Device\VolumeFilter" );
status = IoCreateDevice(DriverObject,
DEVICE_EXTENSION_SIZE,
&volumeFilter,
FILE_DEVICE_DISK,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&filterDeviceObject);

if (!NT_SUCCESS(status)) {
DebugPrint((1, “VolDrvAddDevice: Cannot create filterDeviceObject\n”));
return status;
}

filterDeviceObject->Flags |= DO_DIRECT_IO;

deviceExtension = (PDEVICE_EXTENSION) filterDeviceObject->DeviceExtension;

RtlZeroMemory(deviceExtension, DEVICE_EXTENSION_SIZE);

RtlInitUnicodeString( &deviceName,L"\Device\Harddisk0\Partition3");

deviceExtension->fileObject = ExAllocatePool(NonPagedPool,sizeof(FILE_OBJECT));

if(deviceExtension->fileObject == NULL)
{
DebugPrint((1,“ExAllocatePoolWithTag failed for VolumeDeviceObject\n”));
KeBugCheckEx(0xFFFFFFFF,0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF,0xFFFFFFFF);

}

// get pointer to target device object

status = IoGetDeviceObjectPointer( &deviceName,
FILE_READ_DATA,
&deviceExtension->fileObject,
&VolumeDeviceObject );

if( !NT_SUCCESS(status) )
{
DebugPrint((1,“IoGetDeviceObjectPointer failed with status %d\n”));
return status;
}

obj = IoAttachDeviceToDeviceStack( filterDeviceObject,
VolumeDeviceObject
);
if( obj == NULL )
{
DebugPrint((1,“IoAttachDeviceToDeviceStack failed\n”));

Thanks in advance.
Regards,
Ameet


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Hi All,

I have tried to use diskperf sample from Windows Driver Kit on my Windows 7 Virtual Box VM. It shows BSOD on booting up(STOP:0x0000007B i.e in accessable boot device) .Please suggest a work around for this. Also please suggest how should I convert diskperf to a volume filter.
My requirements are modest, I just want to load a volume filter driver. Also, can I make it demand loaded driver?
Thanks in advance.
Regards,
AG

You can make it demand load if you install it as a device upper filter for the specific volumes you want to filter, basically pnp decides when to load your driver. In the pnp world , you the user do not load the driver when you want to

d

debt from my phone

-----Original Message-----
From: xxxxx@gmail.com
Sent: Thursday, September 01, 2011 7:53 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Issues with volume filter driver

Hi All,

I have tried to use diskperf sample from Windows Driver Kit on my Windows 7 Virtual Box VM. It shows BSOD on booting up(STOP:0x0000007B i.e in accessable boot device) .Please suggest a work around for this. Also please suggest how should I convert diskperf to a volume filter.
My requirements are modest, I just want to load a volume filter driver. Also, can I make it demand loaded driver?
Thanks in advance.
Regards,
AG


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

>I have tried to use diskperf sample from Windows Driver Kit on my Windows 7 Virtual Box VM. It >shows BSOD on booting up(STOP:0x0000007B i.e in accessable boot device) .Please suggest a work >around for this.
BSOD shows that your filter installs on top of the bootable partition and your filter doesn’t transfer some of IOCTLs. In general, the boot partition could not start in time because of your filter driver.You need to use WinDbg to debug the error.

Igor Sharovar

Hi All,

Now I am using diskperf approach to solve my problem. My problem is I want to process requests for one particular volume/disk. As Mark suggested I should check for correct device in AddDevice.
My question is how ? AddDevice gets called with targetdeviceobject. But DEVICE_OBJECT structure does not have name of the device. So how will I attach to the specific device.
Please help. Thanks in advance.
Regards,
Ameet

You wouldn’t use the device object name anyway. Disk device object names aren’t persistent across boots and the format can change from release to release, so they’re a bad thing to rely on.

One option would be to use IOCTL_STORAGE_GET_DEVICE_NUMBER to get the disk number and partition number if you’re loading in the disk stack. If you’re loading on a volume then you’d want to get the volume ID using IOCTL_MOUNTDEV_QUERY_UNIQUE_ID and match to that.

However it’s probably easier to set a registry property on the device node for the disk/volume you want to filter and then query that property during AddDevice. If you find the property on the device then you do your filtering. Otherwise you pass everything through (or don’t bother to attach to the device stack at all).

-p

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Saturday, September 03, 2011 4:47 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Issues with volume filter driver

Hi All,

Now I am using diskperf approach to solve my problem. My problem is I want to process requests for one particular volume/disk. As Mark suggested I should check for correct device in AddDevice.
My question is how ? AddDevice gets called with targetdeviceobject. But DEVICE_OBJECT structure does not have name of the device. So how will I attach to the specific device.
Please help. Thanks in advance.
Regards,
Ameet


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Once you’ve done the AddDevice(), which you must do for every instance,
the next step in processing is when IRP_MN_START_DEVICE arrives. At
this point the device stack is complete and PnP is telling it to start.

When processing IRP_MN_START_DEVICE you can use any ioctl to interrogate
the lower device - you can’t do this in AddDevice(). There’s probably a
few things you want to do here, but as a starting point to retrieve the
volume name I’d suggest IOCTL_MOUNTDEV_QUERY_DEVICE_NAME. Now you can
do some name matching and decide if this instance is going to do any
work or just be a pass-thru instance.

Mark.

On 03/09/2011 12:47, xxxxx@gmail.com wrote:

Hi All,

Now I am using diskperf approach to solve my problem. My problem is I want to process requests for one particular volume/disk. As Mark suggested I should check for correct device in AddDevice.
My question is how ? AddDevice gets called with targetdeviceobject. But DEVICE_OBJECT structure does not have name of the device. So how will I attach to the specific device.
Please help. Thanks in advance.
Regards,
Ameet


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Use PnP way of attach instead.

wrote in message news:xxxxx@ntdev…

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

1 Like