KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

  1. Creates a queue just for IRP_MJ_CREATE requests.

  2. Configures request dispatching for WdfRequestTypeCreate to the
    queue.

  3. In the EvtIoDefault handler for the queue does some processing and
    then calls WdfRequestFormatRequestUsingCurrentType() and then
    WdfRequestSend() to the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location. My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through - probably
because the IRPSP is ‘skipped’ and the original is used.

Two questions:

  1. How do I make this work the way I expect? That is, to ensure the
    FileObject is carried to the next stack location in the IRP?

  2. What is going on here? Why does KMDF do this? Does it do this for
    other requests too because all of the requests in this stack are seriously
    expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane. I am working from the assumption that I
just don’t know what I am doing and that there is some easy way to make this
work ‘the way WDM works’.

TIA,

Dave Cattley

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver *does* set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did *not* have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

  1. Creates a queue just for IRP_MJ_CREATE requests.
  2. Configures request dispatching for WdfRequestTypeCreate to the queue.
  3. In the EvtIoDefault handler for the queue does some processing and then
    calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
    the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location.? My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through ? probably
because the IRPSP is ?skipped? and the original is used.

Two questions:

  1. ?How do I make this work the way I expect?? That is, to ensure the
    FileObject is carried to the next stack location in the IRP?
  2. What is going on here?? Why does KMDF do this?? Does it do this for other
    requests too because all of the requests in this stack are seriously
    expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane.?? I am working from the assumption that I
just don?t know what I am doing and that there is some easy way to make this
work ?the way WDM works?.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver *does* set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did *not* have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

  1. Creates a queue just for IRP_MJ_CREATE requests.
  2. Configures request dispatching for WdfRequestTypeCreate to the queue.
  3. In the EvtIoDefault handler for the queue does some processing and then
    calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
    the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location.? My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through ? probably
because the IRPSP is ?skipped? and the original is used.

Two questions:

  1. ?How do I make this work the way I expect?? That is, to ensure the
    FileObject is carried to the next stack location in the IRP?
  2. What is going on here?? Why does KMDF do this?? Does it do this for other
    requests too because all of the requests in this stack are seriously
    expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane.?? I am working from the assumption that I
just don?t know what I am doing and that there is some easy way to make this
work ?the way WDM works?.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

> Perhaps the framework is protecting me from my own stupidity here and refusing to attach a file object to the request?

Doubtful we are being that “smart”

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 7:41 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver *does* set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did *not* have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

  1. Creates a queue just for IRP_MJ_CREATE requests.
  2. Configures request dispatching for WdfRequestTypeCreate to the queue.
  3. In the EvtIoDefault handler for the queue does some processing and then
    calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
    the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location.? My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through ? probably
because the IRPSP is ?skipped? and the original is used.

Two questions:

  1. ?How do I make this work the way I expect?? That is, to ensure the
    FileObject is carried to the next stack location in the IRP?
  2. What is going on here?? Why does KMDF do this?? Does it do this for other
    requests too because all of the requests in this stack are seriously
    expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane.?? I am working from the assumption that I
just don?t know what I am doing and that there is some easy way to make this
work ?the way WDM works?.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Doron,

So is there an approach for this? Dave is not the only one facing
this, I am on two different projects. For one of them I have determined
that my old WDM filter will be a lot smaller and simpler than my new KMDF
filter if I have to create seperate IOTARGETS for every FILE_OBJECT I see
and want to track. This would be a first I think, “Gee make the driver
easier and HALF THE SIZE by eliminating KMDF!”


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Doron Holan” wrote in message
news:xxxxx@ntdev…
> Perhaps the framework is protecting me from my own stupidity here and
> refusing to attach a file object to the request?

Doubtful we are being that “smart”

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 7:41 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver does set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did not have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

1. Creates a queue just for IRP_MJ_CREATE requests.
2. Configures request dispatching for WdfRequestTypeCreate to the queue.
3. In the EvtIoDefault handler for the queue does some processing and then
calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location. My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through – probably
because the IRPSP is ‘skipped’ and the original is used.

Two questions:

1. How do I make this work the way I expect? That is, to ensure the
FileObject is carried to the next stack location in the IRP?
2. What is going on here? Why does KMDF do this? Does it do this for other
requests too because all of the requests in this stack are seriously
expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane. I am working from the assumption that I
just don’t know what I am doing and that there is some easy way to make this
work ‘the way WDM works’.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET NOD32 Antivirus, version of virus signature
database 4082 (20090518)


The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Information from ESET NOD32 Antivirus, version of virus signature database 4082 (20090518)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

I think the answer to this depends on what filter you are and what stack you are in. For file system filters this is not supported
(“IRP_MJ_CREATE requests cannot be performed asynchronously” ©). Possibly the good answer is that you should always expect creates
to be possibly async but never pend them yourself as you will find yourself on thin ice.

//Daniel

“David R. Cattley” wrote in message news:xxxxx@ntdev…
Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Daniel,

Thank you for your thoughts. I agree completely.

I own the entire stack (not personally, of course!) and so know what the
other Filters and FDO are doing.

I also think (after a good night’s sleep) that I either had or was on the
verge of breaking that rule in the driver structure I was building up. I am
discarding that approach for a pure synchronous approach of handling
IRP_MJ_CREATE (in the filter).

I am still, however, at a complete loss to explain my observed behavior of
KDMF.

I know in WDM that IoCopyCurrentIrpStackLocationToNext() copies the
FileObject field in the IO_STACK_LOCATION.

I expected that WdfRequestFormatRequestUsingCurrentType() would do the same.

So I have a gap in understanding of what is going on in KMDF that I still
would very much like to fill so as to avoid falling into it again :slight_smile:

Cheers,
-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@resplendence.com
Sent: Monday, May 18, 2009 9:16 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I think the answer to this depends on what filter you are and what stack you
are in. For file system filters this is not supported
(“IRP_MJ_CREATE requests cannot be performed asynchronously” ?). Possibly
the good answer is that you should always expect creates
to be possibly async but never pend them yourself as you will find yourself
on thin ice.

//Daniel

“David R. Cattley” wrote in message news:xxxxx@ntdev…
Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Wait… You’re NOT trying to write a FILE SYSTEM filter driver using KMDF, are you?

That would be a pretty tall order, I think…

Peter
OSR

Oh heavens no. I expect to retire before I have to read the FAQ on NTFSD and
start annoying the other half of OSR with my ignorance!

This device stack was conceived with some ‘help’ for IRP_MJ_CREATE in an
upper filter. It does share some challenges in common with some FSD
filtering scenarios but none of the FSD specific (cache mgr, etc.)
specifics.

  • Creates can be ‘failed’ by the upper filter.
  • It might take some time to figure out in the upper filter if the Create
    should be allowed to continue.
  • It requires the services of the (lower) driver stack ‘by’ the filter to
    determine if the Create should be allowed to continue.
  • The filter needs to know if the Create succeeds if it is permitted to
    continue.

It all seems pretty straight-forward. All of the work required to qualify
the Create can be performed at <=DISPATCH_LEVEL and the lower stack
supports all of the required I/O at DISPATCH_LEVEL. The only thing to do
at PASSIVE_LEVEL synchronously in the context of the Create is to hang out
and wait for the result of the qualification.

I would very much like to have Create cancelation in there of course and
that is why I errantly went down the path of dispatching Create request to a
sequential queue. I realize now (with enough rest) that that is a bad idea.
Cancelation will have to be a bit more work.

Tony is safe for another day :wink:

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@osr.com
Sent: Monday, May 18, 2009 9:53 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Wait… You’re NOT trying to write a FILE SYSTEM filter driver using KMDF,
are you?

That would be a pretty tall order, I think…

Peter
OSR


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Peter,

In my case I want to filter a device that uses a namespace. As part
of this, I need to catch the completion of CREATE’s in a KMDF driver, and be
able to filter some other calls. So far the only solution I see that works
in KMDF is:

  1. Catch the create, and do a WdfIoTargetCreate and
    WdfIoTargetOpen to forward the create request to the lower driver.
  2. Keep the IOTARGET in a File Object context, and use it to pass
    all the requests down, even ones I don’t otherwise care about.
  3. Cleanup the IOTARGET on the File Object Context completion.

Note: for one of the two filters I am facing, I was not expecting to
use a FILE OBJECT CONTEXT at all!


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

wrote in message news:xxxxx@ntdev…
>


>
> Wait… You’re NOT trying to write a FILE SYSTEM filter driver using KMDF,
> are you?
>
> That would be a pretty tall order, I think…
>
> Peter
> OSR
>
>
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4083 (20090518)

>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>

Information from ESET NOD32 Antivirus, version of virus signature database 4083 (20090518)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

I am waiting to get in to look at the src or let one of my colleagues answer in the interim.

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

-----Original Message-----
From: Don Burn
Sent: Monday, May 18, 2009 5:22 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

Doron,

So is there an approach for this? Dave is not the only one facing
this, I am on two different projects. For one of them I have determined
that my old WDM filter will be a lot smaller and simpler than my new KMDF
filter if I have to create seperate IOTARGETS for every FILE_OBJECT I see
and want to track. This would be a first I think, “Gee make the driver
easier and HALF THE SIZE by eliminating KMDF!”


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Doron Holan” wrote in message
news:xxxxx@ntdev…
> Perhaps the framework is protecting me from my own stupidity here and
> refusing to attach a file object to the request?

Doubtful we are being that “smart”

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 7:41 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver does set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did not have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

1. Creates a queue just for IRP_MJ_CREATE requests.
2. Configures request dispatching for WdfRequestTypeCreate to the queue.
3. In the EvtIoDefault handler for the queue does some processing and then
calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location. My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through ? probably
because the IRPSP is ?skipped? and the original is used.

Two questions:

1. How do I make this work the way I expect? That is, to ensure the
FileObject is carried to the next stack location in the IRP?
2. What is going on here? Why does KMDF do this? Does it do this for other
requests too because all of the requests in this stack are seriously
expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane. I am working from the assumption that I
just don?t know what I am doing and that there is some easy way to make this
work ?the way WDM works?.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET NOD32 Antivirus, version of virus signature
database 4082 (20090518)


The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Information from ESET NOD32 Antivirus, version of virus signature database 4082 (20090518)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Of course there is always WDM Preprocessing on IRP_MJ_CREATE and then
letting the framework do its thing without knowing that the Irp was held up
by the filter. I was looking for something less ‘escape-ish’ if it exists.

Thanks,
-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 18, 2009 10:12 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

I am waiting to get in to look at the src or let one of my colleagues answer
in the interim.

d

Sent from my phone with no t9, all spilling mistakes are not intentional.

-----Original Message-----
From: Don Burn
Sent: Monday, May 18, 2009 5:22 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Doron,

So is there an approach for this? Dave is not the only one facing
this, I am on two different projects. For one of them I have determined
that my old WDM filter will be a lot smaller and simpler than my new KMDF
filter if I have to create seperate IOTARGETS for every FILE_OBJECT I see
and want to track. This would be a first I think, “Gee make the driver
easier and HALF THE SIZE by eliminating KMDF!”


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Doron Holan” wrote in message
news:xxxxx@ntdev…
> Perhaps the framework is protecting me from my own stupidity here and
> refusing to attach a file object to the request?

Doubtful we are being that “smart”

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 7:41 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver does set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did not have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

1. Creates a queue just for IRP_MJ_CREATE requests.
2. Configures request dispatching for WdfRequestTypeCreate to the queue.
3. In the EvtIoDefault handler for the queue does some processing and then
calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location. My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through ? probably
because the IRPSP is ?skipped? and the original is used.

Two questions:

1. How do I make this work the way I expect? That is, to ensure the
FileObject is carried to the next stack location in the IRP?
2. What is going on here? Why does KMDF do this? Does it do this for other
requests too because all of the requests in this stack are seriously
expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane. I am working from the assumption that I
just don?t know what I am doing and that there is some easy way to make this
work ?the way WDM works?.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET NOD32 Antivirus, version of virus signature
database 4082 (20090518)


The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Information from ESET NOD32 Antivirus, version of virus signature
database 4082 (20090518)


The message was checked by ESET NOD32 Antivirus.

http://www.eset.com


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

My faith is restored.

Using EvtDeviceFileCreate in the filter and forwarding the Create Request
synchronously to the default I/O target works just peachy.

Incidentally, I need to correct a misstatement I made earlier.

Calling WdfRequestFormatRequestUsingCurrentType() does indeed copy the
FileObject to the next stack location. The debugger shows me so.

Using the Create Request so formatted with WdfRequestSend(Request,
WdfDeviceGetIoTarget(Device), &options) where options have been setup with
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS does correctly result in the I/O Stack
Location presented to the lower driver having the FileObject non-null and
correct.

I am still quite curious, however, as to why a Create Request when
dispatched to a queue and then forwarded asynchronously (albeit this is a
bad thing to do) results in a NULL FileObject in the next I/O Stack
Location. My concern is simply “does this happen because it was a Create
or does it happen for other requests too?”

Thanks,
-Dave

I am a little lost as to what was going wrong for you. Formatting a read/write/IOCTL follows the following logic for the next stack location

  1. if the target is not an in stack (default, usb device or pipe essentially) target, use the target’s file object
  2. use the file object in the current stack location

FormatUsingCurrentType just does an IoCopyCurrentIrpStackLocationToNext and that will copy the file object to the next stack location. The fact that the create was async does not matter. If you created a top level queue to handle the dispatching of requests, we alloc a WDFREQUEST and put it into the queue. What you do with it once presented is the same as if you process it via EvtDeviceFileCreate (e.g. you must eventually complete it :wink: ). The only thing you can really do with a create is fail it outright or FormatUsingCurrentType() which we know does set the fileobject correctly.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 8:39 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

My faith is restored.

Using EvtDeviceFileCreate in the filter and forwarding the Create Request
synchronously to the default I/O target works just peachy.

Incidentally, I need to correct a misstatement I made earlier.

Calling WdfRequestFormatRequestUsingCurrentType() does indeed copy the
FileObject to the next stack location. The debugger shows me so.

Using the Create Request so formatted with WdfRequestSend(Request,
WdfDeviceGetIoTarget(Device), &options) where options have been setup with
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS does correctly result in the I/O Stack
Location presented to the lower driver having the FileObject non-null and
correct.

I am still quite curious, however, as to why a Create Request when
dispatched to a queue and then forwarded asynchronously (albeit this is a
bad thing to do) results in a NULL FileObject in the next I/O Stack
Location. My concern is simply “does this happen because it was a Create
or does it happen for other requests too?”

Thanks,
-Dave


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

What are you tracking per fileobject? You can tell KMDF to create WDFFILEOBJECTs and track information there. Kmdf should be setting the fileobject in the read/write/ioctl/internal ioctl irps for you correctly if formatted properly. What version of kmdf are you using? We copy over the fileobject since at least v1.5

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Monday, May 18, 2009 5:21 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

Doron,

So is there an approach for this? Dave is not the only one facing
this, I am on two different projects. For one of them I have determined
that my old WDM filter will be a lot smaller and simpler than my new KMDF
filter if I have to create seperate IOTARGETS for every FILE_OBJECT I see
and want to track. This would be a first I think, “Gee make the driver
easier and HALF THE SIZE by eliminating KMDF!”


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Doron Holan” wrote in message
news:xxxxx@ntdev…
> Perhaps the framework is protecting me from my own stupidity here and
> refusing to attach a file object to the request?

Doubtful we are being that “smart”

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 7:41 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Only the truly crazy ask & answer their own questions. I guess I qualify
(actually, I am sure).

I think my error is the following:

Queueing an IRP_MJ_CREATE in a filter driver is breaking the rules (I think)
because forwarding it to the next lower driver other than synchronously
would potentially put it in an arbitrary thread context.

Perhaps the framework is protecting me from my own stupidity here and
refusing to attach a file object to the request?

If this is indeed the case (thank your KMDF) then how to achieve aim of the
whole thing. To hold up the IRP_MJ_CREATE I just hang out in the
EvtDeviceFileCreate callback until whatever my Filter needs to get done is
done (it is as PASSIVE_LEVEL) and allow it to ‘proceed’ when the filter
processing completes by forwarding the Request to the default I/O target
with a CRTN set on it?

I have myself thoroughly confused at this point.

-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:45 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I want to fill in some additional details here so that they might avoid
being the first things I need to answer to clarify:

(a) The Filter Driver is KMDF 1.9 based.

(b) The Filter Driver configures the framework to create WDFFILEOBJECTs for
it but specifies them as (WdfFileObjectCannotUseFsContexts |
WdfFileObjectCanBeOptional). I believe this is a KMDF 1.9 ‘new feature’.

(c) The Filter Driver does set a completion routine on the Create Request
before forwarding it to the next lower driver. The CRTN does the ‘trivial’
operation of simply completing the Request again with the same status.

(d) The Filter Driver configures a default queue (parallel) to process all
of the other requests which presently are IPR_MJ_DEVICE_CONTROL or
IRP_MJ_INTERNAL_DEVICE_CONTROL. Nothing exciting here.

(e) The Queue configured for IRP_MJ_CREATE requests is a sequential queue.

(f) When the Filter Driver was sending Create requests with send&forget, it
did not have the framework creating WDFFILEOBJECTs for it. That was an
intermediate stage of development. The real requirement is to have the
framework create WDFFILEOBJECTs (and not use either FsContext fields).
However, it is possible that requests can come to the Filter Driver (and to
the lower FDO) without a FileObject in the IO_STACK_LOCATION.

Too much information?

Thanks,
Dave Cattley

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Sunday, May 17, 2009 9:12 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

I have a WDF (KMDF) Filter Driver that very much would like to queue
IRP_MJ_CREATE requests, do some stuff that might result in failure, forward
the IRP_MJ_CREATE, and then be aware of the IRP_MJ_CREATE completion.

This is not a tall order as in WDM it is pretty trivial.

My KMDF filter does the following:

1. Creates a queue just for IRP_MJ_CREATE requests.
2. Configures request dispatching for WdfRequestTypeCreate to the queue.
3. In the EvtIoDefault handler for the queue does some processing and then
calls WdfRequestFormatRequestUsingCurrentType() and then WdfRequestSend() to
the default I/O target.

When the IRP hits the next lower driver the IO_STACK_LOCATION does not
FileObject set.

Yes, FileObject is set in the previous stack location. My Create processing
uses the FileObject.

If I send the Request to the default I/O target with send & forget (not
copying the request parameters) the FileObject is carried through - probably
because the IRPSP is ‘skipped’ and the original is used.

Two questions:

1. How do I make this work the way I expect? That is, to ensure the
FileObject is carried to the next stack location in the IRP?
2. What is going on here? Why does KMDF do this? Does it do this for other
requests too because all of the requests in this stack are seriously
expecting to see a FileObject when they get to the Function Driver.

The idea that I might need to create a (non-default) I/O Target per
FileObject and redirect all requests in the filter into a different
(non-default) I/O target just to get the (WDM) FileObject set in the
IO_STACK_LOCATION seems insane. I am working from the assumption that I
just don’t know what I am doing and that there is some easy way to make this
work ‘the way WDM works’.

TIA,
Dave Cattley


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Information from ESET NOD32 Antivirus, version of virus signature
database 4082 (20090518)


The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Information from ESET NOD32 Antivirus, version of virus signature database 4082 (20090518)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Doron,

I have the situation of I want to do a filter, that needs to change a
device I/O control into an internal device I/O control with a different
input buffer, but with the same FILE_OBJECT. So how does one do something
on the order of:

status = WdfIoTargetFormatRequestForInternalIoctl(…);
WdfRequestSetCompletionRoutine( Request, Complete, NULL );
if ( !WdfRequestSend( Request, WdfDeviceGetIoTarget( Device ),
WDF_NO_SEND_OPTIONS ) )
{

As far as I can tell if I need the FILE_OJECT but have to modify the
buffer, I have to stand on my head. Like all of us, I am still learning
WDF, but this one is confusing me. I am right now trying Dave Cattley’s
change for create, but once I get that how do I do the above, if I can’t I
think I need to handle the create myself, then copy all of the parmeters
into an WdfIoTargetOpen and record this new IOTARGET in my WDF file object
context.


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Doron Holan” wrote in message
news:xxxxx@ntdev…
What are you tracking per fileobject? You can tell KMDF to create
WDFFILEOBJECTs and track information there. Kmdf should be setting the
fileobject in the read/write/ioctl/internal ioctl irps for you correctly if
formatted properly. What version of kmdf are you using? We copy over the
fileobject since at least v1.5

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Monday, May 18, 2009 5:21 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding
IRP_MJ_CREATE through a filter driver?

Doron,

So is there an approach for this? Dave is not the only one facing
this, I am on two different projects. For one of them I have determined
that my old WDM filter will be a lot smaller and simpler than my new KMDF
filter if I have to create seperate IOTARGETS for every FILE_OBJECT I see
and want to track. This would be a first I think, “Gee make the driver
easier and HALF THE SIZE by eliminating KMDF!”


Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

Information from ESET NOD32 Antivirus, version of virus signature database 4084 (20090518)

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com

Doron,

What was going wrong was that when processed the Create request dispatched
to the queue with


WDF_REQUEST_SEND_OPTIONS options;
BOOLEAN success;

WDF_REQUEST_SEND_OPTIONS_INIT(&options,
WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET);
success = WdfRequestSend(Request, WdfDeviceGetioTarget(device),
&options);
if (!success)
{
NTSTATUS requestStatus = WdfRequestGetStatus(Request);
WdfRequestComplete(Request, requestStatus);
}

when the request got to the next lower driver, the current stack location
FileObject field was NULL.

Is it possible then that my error was more simple? I did not call
WdfRequestFormatRequestUsingCurrentType() as I thought that with Send&Forget
that was optional.

If that is *not* optional then perhaps the entire IO_STACK_LOCATION was sent
as ‘zeros’. IRP_MJ_CREATE == 0, right?

What I interpreted as KMDF zeroing the FileObject might really have been
KMDF expecting me to have called WdfRequestFormatRequestUsingCurrentType().


A driver that sets the WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET flag
typically does not format the I/O request before it calls WdfRequestSend to
send the request to an I/O target. In fact, a driver that sets this flag
must not call any of the WdfIoTargetFormatRequestForXxx methods before it
calls WdfRequestSend. The driver can use only the
WdfRequestFormatRequestUsingCurrentType or
WdfRequestWdmFormatUsingStackLocation method to format the request.

So, is this perhaps not quite true?

Thanks,
-dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 18, 2009 1:15 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

I am a little lost as to what was going wrong for you. Formatting a
read/write/IOCTL follows the following logic for the next stack location

  1. if the target is not an in stack (default, usb device or pipe
    essentially) target, use the target’s file object
  2. use the file object in the current stack location

FormatUsingCurrentType just does an IoCopyCurrentIrpStackLocationToNext and
that will copy the file object to the next stack location. The fact that
the create was async does not matter. If you created a top level queue to
handle the dispatching of requests, we alloc a WDFREQUEST and put it into
the queue. What you do with it once presented is the same as if you process
it via EvtDeviceFileCreate (e.g. you must eventually complete it :wink: ). The
only thing you can really do with a create is fail it outright or
FormatUsingCurrentType() which we know does set the fileobject correctly.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 8:39 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

My faith is restored.

Using EvtDeviceFileCreate in the filter and forwarding the Create Request
synchronously to the default I/O target works just peachy.

Incidentally, I need to correct a misstatement I made earlier.

Calling WdfRequestFormatRequestUsingCurrentType() does indeed copy the
FileObject to the next stack location. The debugger shows me so.

Using the Create Request so formatted with WdfRequestSend(Request,
WdfDeviceGetIoTarget(Device), &options) where options have been setup with
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS does correctly result in the I/O Stack
Location presented to the lower driver having the FileObject non-null and
correct.

I am still quite curious, however, as to why a Create Request when
dispatched to a queue and then forwarded asynchronously (albeit this is a
bad thing to do) results in a NULL FileObject in the next I/O Stack
Location. My concern is simply “does this happen because it was a Create
or does it happen for other requests too?”

Thanks,
-Dave


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Send and forget is the equivalent of IoSkipCurrentIrpStackLocation+IoCallDriver. In the send and forget case we do not touch any stack locations at all. Can you run !irp on the irp right before the send and forget in your driver and then when the lower driver gets the irp? They should be the same, down to the current irp stack location

Note that send and forget for a create is a bit problematic. If the lower driver completes the request with failure, your upper filter will never see it and hang on to the WDFFILEOBJECT forever (at least until stack teardown). I will get the docs updated if they are not clear here. Please use the send feedback link in msdn to do the same to make sure it gets tracked.

d

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 10:45 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when forwarding IRP_MJ_CREATE through a filter driver?

Doron,

What was going wrong was that when processed the Create request dispatched
to the queue with


WDF_REQUEST_SEND_OPTIONS options;
BOOLEAN success;

WDF_REQUEST_SEND_OPTIONS_INIT(&options,
WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET);
success = WdfRequestSend(Request, WdfDeviceGetioTarget(device),
&options);
if (!success)
{
NTSTATUS requestStatus = WdfRequestGetStatus(Request);
WdfRequestComplete(Request, requestStatus);
}

when the request got to the next lower driver, the current stack location
FileObject field was NULL.

Is it possible then that my error was more simple? I did not call
WdfRequestFormatRequestUsingCurrentType() as I thought that with Send&Forget
that was optional.

If that is *not* optional then perhaps the entire IO_STACK_LOCATION was sent
as ‘zeros’. IRP_MJ_CREATE == 0, right?

What I interpreted as KMDF zeroing the FileObject might really have been
KMDF expecting me to have called WdfRequestFormatRequestUsingCurrentType().


A driver that sets the WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET flag
typically does not format the I/O request before it calls WdfRequestSend to
send the request to an I/O target. In fact, a driver that sets this flag
must not call any of the WdfIoTargetFormatRequestForXxx methods before it
calls WdfRequestSend. The driver can use only the
WdfRequestFormatRequestUsingCurrentType or
WdfRequestWdmFormatUsingStackLocation method to format the request.

So, is this perhaps not quite true?

Thanks,
-dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 18, 2009 1:15 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

I am a little lost as to what was going wrong for you. Formatting a
read/write/IOCTL follows the following logic for the next stack location

  1. if the target is not an in stack (default, usb device or pipe
    essentially) target, use the target’s file object
  2. use the file object in the current stack location

FormatUsingCurrentType just does an IoCopyCurrentIrpStackLocationToNext and
that will copy the file object to the next stack location. The fact that
the create was async does not matter. If you created a top level queue to
handle the dispatching of requests, we alloc a WDFREQUEST and put it into
the queue. What you do with it once presented is the same as if you process
it via EvtDeviceFileCreate (e.g. you must eventually complete it :wink: ). The
only thing you can really do with a create is fail it outright or
FormatUsingCurrentType() which we know does set the fileobject correctly.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 8:39 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

My faith is restored.

Using EvtDeviceFileCreate in the filter and forwarding the Create Request
synchronously to the default I/O target works just peachy.

Incidentally, I need to correct a misstatement I made earlier.

Calling WdfRequestFormatRequestUsingCurrentType() does indeed copy the
FileObject to the next stack location. The debugger shows me so.

Using the Create Request so formatted with WdfRequestSend(Request,
WdfDeviceGetIoTarget(Device), &options) where options have been setup with
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS does correctly result in the I/O Stack
Location presented to the lower driver having the FileObject non-null and
correct.

I am still quite curious, however, as to why a Create Request when
dispatched to a queue and then forwarded asynchronously (albeit this is a
bad thing to do) results in a NULL FileObject in the next I/O Stack
Location. My concern is simply “does this happen because it was a Create
or does it happen for other requests too?”

Thanks,
-Dave


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Ok, I understand. I have already made the design changes to deal with the
Create more appropriately. At the point in the driver implementation below
it was not requesting the framework to create WDFFILEOBJECTs.

And to make me look like even a bigger idiot, I turned the knob on the
way-back-machine (source control), rebuilt the driver that I was convinced
was doing what I said (NULL FileObject), re-ran my test under controlled
conditions, and see that indeed FileObject != NULL, the stack pointer is
exactly as it should be (skipped), and nothing is wrong.

I hate computers.

Last night I did that same experiment three times to be sure I was seeing
what I was seeing before posting originally. I have no idea why now the
stack location seemed goofed. I wonder if I was looking after the IRP had
been completed (and the stack location partially zeroed).

Sigh. Sorry for bothering you (all).

I realize that Don’s issue is unrelated and more likely to do with using
WdfIoTargetFormatRequestXxxx() with the ‘default’ I/O target which does not
have a FileObject associated with it.

My issue is that evidently I should be knitting mittens with five thumbs
each and not writing drivers.

Thanks for your help.
-Dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 18, 2009 1:59 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

Send and forget is the equivalent of
IoSkipCurrentIrpStackLocation+IoCallDriver. In the send and forget case we
do not touch any stack locations at all. Can you run !irp on the irp right
before the send and forget in your driver and then when the lower driver
gets the irp? They should be the same, down to the current irp stack
location

Note that send and forget for a create is a bit problematic. If the lower
driver completes the request with failure, your upper filter will never see
it and hang on to the WDFFILEOBJECT forever (at least until stack teardown).
I will get the docs updated if they are not clear here. Please use the send
feedback link in msdn to do the same to make sure it gets tracked.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 10:45 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

Doron,

What was going wrong was that when processed the Create request dispatched
to the queue with


WDF_REQUEST_SEND_OPTIONS options;
BOOLEAN success;

WDF_REQUEST_SEND_OPTIONS_INIT(&options,
WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET);
success = WdfRequestSend(Request, WdfDeviceGetioTarget(device),
&options);
if (!success)
{
NTSTATUS requestStatus = WdfRequestGetStatus(Request);
WdfRequestComplete(Request, requestStatus);
}

when the request got to the next lower driver, the current stack location
FileObject field was NULL.

Is it possible then that my error was more simple? I did not call
WdfRequestFormatRequestUsingCurrentType() as I thought that with Send&Forget
that was optional.

If that is *not* optional then perhaps the entire IO_STACK_LOCATION was sent
as ‘zeros’. IRP_MJ_CREATE == 0, right?

What I interpreted as KMDF zeroing the FileObject might really have been
KMDF expecting me to have called WdfRequestFormatRequestUsingCurrentType().


A driver that sets the WDF_REQUEST_SEND_OPTION_SEND_AND_FORGET flag
typically does not format the I/O request before it calls WdfRequestSend to
send the request to an I/O target. In fact, a driver that sets this flag
must not call any of the WdfIoTargetFormatRequestForXxx methods before it
calls WdfRequestSend. The driver can use only the
WdfRequestFormatRequestUsingCurrentType or
WdfRequestWdmFormatUsingStackLocation method to format the request.

So, is this perhaps not quite true?

Thanks,
-dave

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Monday, May 18, 2009 1:15 PM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

I am a little lost as to what was going wrong for you. Formatting a
read/write/IOCTL follows the following logic for the next stack location

  1. if the target is not an in stack (default, usb device or pipe
    essentially) target, use the target’s file object
  2. use the file object in the current stack location

FormatUsingCurrentType just does an IoCopyCurrentIrpStackLocationToNext and
that will copy the file object to the next stack location. The fact that
the create was async does not matter. If you created a top level queue to
handle the dispatching of requests, we alloc a WDFREQUEST and put it into
the queue. What you do with it once presented is the same as if you process
it via EvtDeviceFileCreate (e.g. you must eventually complete it :wink: ). The
only thing you can really do with a create is fail it outright or
FormatUsingCurrentType() which we know does set the fileobject correctly.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Monday, May 18, 2009 8:39 AM
To: Windows System Software Devs Interest List
Subject: RE: Re:[ntdev] KMDF: Why does FileObject end up NULL when
forwarding IRP_MJ_CREATE through a filter driver?

My faith is restored.

Using EvtDeviceFileCreate in the filter and forwarding the Create Request
synchronously to the default I/O target works just peachy.

Incidentally, I need to correct a misstatement I made earlier.

Calling WdfRequestFormatRequestUsingCurrentType() does indeed copy the
FileObject to the next stack location. The debugger shows me so.

Using the Create Request so formatted with WdfRequestSend(Request,
WdfDeviceGetIoTarget(Device), &options) where options have been setup with
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS does correctly result in the I/O Stack
Location presented to the lower driver having the FileObject non-null and
correct.

I am still quite curious, however, as to why a Create Request when
dispatched to a queue and then forwarded asynchronously (albeit this is a
bad thing to do) results in a NULL FileObject in the next I/O Stack
Location. My concern is simply “does this happen because it was a Create
or does it happen for other requests too?”

Thanks,
-Dave


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

David R. Cattley wrote:

Of course there is always WDM Preprocessing on IRP_MJ_CREATE and then
letting the framework do its thing without knowing that the Irp was held up
by the filter. I was looking for something less ‘escape-ish’ if it exists.

David,
But why these complications? the Create IRP comes
synchronously in the context of the user thread.
So maybe you can call the lower driver also
synchronously, wait when needed, and keep all the
data on the stack ? No queues, no pain.

Regards,
– pa