Volume dismounts

Hello All,

Can anybody shed some light for me on dismounts?

According to http://www.osronline.com/article.cfm?article=17#Q47 I really
thought the IRP_MJ_PNP or IRP_MJ_FILE_SYSTEM_CONTROL should get triggered.
But even the following never returns true when I remove a USB stick - I have
tried to set the following break point, but it only triggers when I plug in
a USB stick for example. When I remove it, I don’t get an event.

What am I missing?

if (Data->Iopb->MajorFunction == IRP_MJ_FILE_SYSTEM_CONTROL ||

Data->Iopb->MajorFunction == IRP_MJ_PNP ||

Data->Iopb->MajorFunction == IRP_MJ_DEVICE_CONTROL ||

Data->Iopb->MajorFunction == IRP_MJ_INTERNAL_DEVICE_CONTROL ||

Data->Iopb->MajorFunction == IRP_MJ_DEVICE_CHANGE ||

Data->Iopb->MajorFunction == IRP_MJ_SYSTEM_CONTROL ||

Data->Iopb->MajorFunction == IRP_MJ_SET_VOLUME_INFORMATION) {

KdPrint((“Hit breakpoint\n”));

}

I also tried this:

if (
(((Data->Iopb_>Parameters.FileSystemControl).Common).FsControlCode ==
FSCTL_DISMOUNT_VOLUME) ) {

KdPrint((“DISMOUNMT\n”));

}

Could somebody please tell me what I am missing?

Thanks!

bjorn

Apologies for the obvious question, but you are registering for all those
major functions? And you are attached correctly (you get called for other
functions?).

“Rod Widdowson” wrote in message
news:xxxxx@ntfsd…
> Apologies for the obvious question, but you are registering for all those
> major functions? And you are attached correctly (you get called for other
> functions?).

Yes, I get the events for the volume mounts correctly - I just don’t get any
dismounts events.

thanks,

bjorn

Log from Filespy (when I remove the USB drive using
“Safely remove hardware”):

1 System IRP_MJ_CLOSE 00000404 8611A118 Z:[-=Not In Cache=-] STATUS_SUCCESS
2 System IRP_MJ_CLOSE 00000404 86104CE0 Z:[-=Not In Cache=-] STATUS_SUCCESS
3 System IRP_MJ_PNP/IRP_MN_QUERY_REMOVE_DEVICE 00000000 00000000
STATUS_SUCCESS
4 System FASTIO_DETACH_DEVICE 00000000 STATUS_SUCCESS

L.

Thanks Ladislav.

When I use the “safe removal” I get:
IRP_MJ_FILE_SYSTEM_CONTROL/IRP_MN_USER_FS_REQUEST
(seems like I get one when I click on “Safe Removal” and one or more when I
actually remove the USB stick).

My previous test was just to remove the USB stick. I would have expected to
see:
IRP_MJ_PNP/IRP_MN_SURPRISE_REMOVAL

I am puzzled I don’t see any PNP IRP.

bjorn

“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> Log from Filespy (when I remove the USB drive using
> “Safely remove hardware”):
>
> 1 System IRP_MJ_CLOSE 00000404 8611A118 Z:[-=Not In Cache=-]
> STATUS_SUCCESS
> 2 System IRP_MJ_CLOSE 00000404 86104CE0 Z:[-=Not In Cache=-]
> STATUS_SUCCESS
> 3 System IRP_MJ_PNP/IRP_MN_QUERY_REMOVE_DEVICE 00000000 00000000
> STATUS_SUCCESS
> 4 System FASTIO_DETACH_DEVICE 00000000 STATUS_SUCCESS
>
> L.
>

“Rod Widdowson” wrote in message
news:xxxxx@ntfsd…
> Apologies for the obvious question, but you are registering for all those
> major functions? And you are attached correctly (you get called for other
> functions?).

Rod,

I guess let me ask this (as I do get notified for all other IRP’s, just not
PNP):

My driver is based off minispy and the way I register is via the
registrationdata.c file that lists all the entrypoints for pre and post
along with the IRP. For PNP, is there anything in addition I need to do?
Right now I just have a couple of debug prints in SpyPreOperationCallback
and SpyPostOperationCallback. It is hit by every other IRP, but not by
IRP_MJ_PNP.

Thanks,

bjorn

>
>
>