Drive discovery issue with lower filter driver
in [Device Drivers]
|
From: Dennis Ginley on 30 Oct 2009 11:07 I'm a software engineer in a storage group, working on a disk IO tracing tool. My tool installs a lower filter driver into the storage stack. I have a problem with USB drives not being discovered after my driver is loaded. Here are the repro steps for what I'm seeing. Do a clean install of Win 7 or Vista, 32 or 64 bits. Install the app. Install the driver. Reboot to load the driver. Plug in a USB drive that has not been plugged into the system before. A message is shown saying "Device driver software was not successfully installed" and the USB drive has a yellow bang in Device Manager. Plug in a USB drive that has been plugged into the system before. That drive is recognized, and can be read and written. Uninstall the lower filter driver Reboot to unload the driver. Plug in any USB drive. That drive is recognized, and can be read and written. Note that this is not the "disappearing DVD" issue. Throughout the above process the DVD is usable. Some more info on this problem. I built a debug driver and got Windbg working. I learned that when I plug in an "old" USB drive, my AddDevice() function gets called, but when I plug in a "new" drive it does not. That immediately suggested the registry, so I opened regedit and plugged in an "old" drive, then searched the registry for it. I found entries in these keys: HKLM\Software\Microsoft\WBEM\WDM HKLM\Software\Microsoft\WBEM\WDM\DREDGE HKLM\Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt HKLM\Software\Microsoft\Windows Portable Devices\Devices HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses (5 entries) HKLM\SYSTEM\CurrentControlSet\Enum\STORAGE\Volume HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR HKLM\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum HKLM\SYSTEM\CurrentControlSet\services\fvevol\Enum HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Enum HKLM\SYSTEM\CurrentControlSet\services\volsnap\Enum HKLM\SYSTEM\CurrentControlSet\services\WUDFRd\Enum plus some in ControlSet001 and ControlSet002 Then I did the same thing with a "new" drive and found only three entires: HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum plus some in ControlSet001 and ControlSet002 It seems like a chicken and egg situation, where the driver isn't loaded because there's a registry entry missing, but the registry isn't being written because the lower filter is present. Thanks, Dennis
From: Don Burn on 30 Oct 2009 11:27 Are you filtering and properly handling the various IRP_MJ_PNP calls especially IRP_MN_QUERY_DEVICE_RELATIONS. If your filter is a low as I believe you are essentially a bus filter and you have to handle these correctly. This is tricky since when you see the IRP_MN_QUERY_DEVICE_RELATIONS you need to discover the changes in the PDO's and do the right thing. -- Don Burn (MVP, Windows DKD) Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr Remove StopSpam to reply "Dennis Ginley" <DennisGinley(a)discussions.microsoft.com> wrote in message news:01B3841E-2FC1-4E1E-98E4-BF499C10E075(a)microsoft.com... > I'm a software engineer in a storage group, working on a disk IO tracing > tool. My tool installs a lower filter driver into the storage stack. I > have a > problem with USB drives not being discovered after my driver is loaded. > > Here are the repro steps for what I'm seeing. > Do a clean install of Win 7 or Vista, 32 or 64 bits. > Install the app. > Install the driver. > Reboot to load the driver. > Plug in a USB drive that has not been plugged into the system before. > A message is shown saying "Device driver software was not successfully > installed" and the USB drive has a yellow bang in Device Manager. > > Plug in a USB drive that has been plugged into the system before. > That drive is recognized, and can be read and written. > > Uninstall the lower filter driver > Reboot to unload the driver. > Plug in any USB drive. > That drive is recognized, and can be read and written. > > Note that this is not the "disappearing DVD" issue. Throughout the above > process the DVD is usable. > > Some more info on this problem. I built a debug driver and got Windbg > working. I learned that when I plug in an "old" USB drive, my AddDevice() > function gets called, but when I plug in a "new" drive it does not. That > immediately suggested the registry, so I opened regedit and plugged in an > "old" drive, then searched the registry for it. I found entries in these > keys: > > HKLM\Software\Microsoft\WBEM\WDM > HKLM\Software\Microsoft\WBEM\WDM\DREDGE > HKLM\Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt > HKLM\Software\Microsoft\Windows Portable Devices\Devices > HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses (5 entries) > HKLM\SYSTEM\CurrentControlSet\Enum\STORAGE\Volume > HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR > HKLM\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB > HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum > HKLM\SYSTEM\CurrentControlSet\services\fvevol\Enum > HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum > HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum > HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Enum > HKLM\SYSTEM\CurrentControlSet\services\volsnap\Enum > HKLM\SYSTEM\CurrentControlSet\services\WUDFRd\Enum > > plus some in ControlSet001 and ControlSet002 > > Then I did the same thing with a "new" drive and found only three entires: > HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum > HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum > HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum > > plus some in ControlSet001 and ControlSet002 > > > It seems like a chicken and egg situation, where the driver isn't loaded > because there's a registry entry missing, but the registry isn't being > written because the lower filter is present. > > Thanks, > Dennis > > __________ Information from ESET NOD32 Antivirus, version of virus > signature database 4558 (20091030) __________ > > The message was checked by ESET NOD32 Antivirus. > > http://www.eset.com > > > __________ Information from ESET NOD32 Antivirus, version of virus signature database 4558 (20091030) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com
From: Dennis Ginley on 9 Nov 2009 12:55 Don, thanks for the reply and suggestion. I added a handler, basically a stub, for IRP_MN_QUERY_DEVICE_RELATIONS, but since my AddDevice is never called, I never see the device at all. I'm thinking that my driver is not being installed as a filter for USB mass storage devices, so I'm investigating how to do that now. Dennis "Don Burn" wrote: > Are you filtering and properly handling the various IRP_MJ_PNP calls > especially IRP_MN_QUERY_DEVICE_RELATIONS. If your filter is a low as I > believe you are essentially a bus filter and you have to handle these > correctly. This is tricky since when you see the > IRP_MN_QUERY_DEVICE_RELATIONS you need to discover the changes in the PDO's > and do the right thing. > > > -- > Don Burn (MVP, Windows DKD) > Windows Filesystem and Driver Consulting > Website: http://www.windrvr.com > Blog: http://msmvps.com/blogs/WinDrvr > Remove StopSpam to reply > > >
From: Brian Catlin [MVP] on 9 Nov 2009 19:38 "Dennis Ginley" <DennisGinley(a)discussions.microsoft.com> wrote in message news:01B3841E-2FC1-4E1E-98E4-BF499C10E075(a)microsoft.com... > I'm a software engineer in a storage group, working on a disk IO tracing > tool. My tool installs a lower filter driver into the storage stack. I > have a > problem with USB drives not being discovered after my driver is loaded. > > Here are the repro steps for what I'm seeing. > Do a clean install of Win 7 or Vista, 32 or 64 bits. > Install the app. > Install the driver. > Reboot to load the driver. > Plug in a USB drive that has not been plugged into the system before. > A message is shown saying "Device driver software was not successfully > installed" and the USB drive has a yellow bang in Device Manager. > > Plug in a USB drive that has been plugged into the system before. > That drive is recognized, and can be read and written. > > Uninstall the lower filter driver > Reboot to unload the driver. > Plug in any USB drive. > That drive is recognized, and can be read and written. > > Note that this is not the "disappearing DVD" issue. Throughout the above > process the DVD is usable. > > Some more info on this problem. I built a debug driver and got Windbg > working. I learned that when I plug in an "old" USB drive, my AddDevice() > function gets called, but when I plug in a "new" drive it does not. That > immediately suggested the registry, so I opened regedit and plugged in an > "old" drive, then searched the registry for it. I found entries in these > keys: > > HKLM\Software\Microsoft\WBEM\WDM > HKLM\Software\Microsoft\WBEM\WDM\DREDGE > HKLM\Software\Microsoft\Windows NT\CurrentVersion\EMDMgmt > HKLM\Software\Microsoft\Windows Portable Devices\Devices > HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses (5 entries) > HKLM\SYSTEM\CurrentControlSet\Enum\STORAGE\Volume > HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR > HKLM\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB > HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum > HKLM\SYSTEM\CurrentControlSet\services\fvevol\Enum > HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum > HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum > HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Enum > HKLM\SYSTEM\CurrentControlSet\services\volsnap\Enum > HKLM\SYSTEM\CurrentControlSet\services\WUDFRd\Enum > > plus some in ControlSet001 and ControlSet002 > > Then I did the same thing with a "new" drive and found only three entires: > HKLM\SYSTEM\CurrentControlSet\services\Disk\Enum > HKLM\SYSTEM\CurrentControlSet\services\ntwiot5\Enum > HKLM\SYSTEM\CurrentControlSet\services\partmgr\Enum > > plus some in ControlSet001 and ControlSet002 > > > It seems like a chicken and egg situation, where the driver isn't loaded > because there's a registry entry missing, but the registry isn't being > written because the lower filter is present. > > Thanks, > Dennis Based upon the symptoms you're reporting, you're not passing down the PNP enumeration IRPs properly. It isn't clear to me where you want to be loaded. Are you trying to create a lower-level Function Filter Device Object (FFDO) or a Bus Filter Device Object (BFDO)? -Brian Brian Catlin, Azius Developer Training, 888-238-4050 x4 Windows device driver training and consulting See www.azius.com for a list of classes
From: Dennis Ginley on 10 Nov 2009 14:25 I'm a lower filter, sitting just below the storage class driver. My AddDevice is called for hard disks, CDs, and for USB keys that were inserted into the test box before my driver was installed, but not for "new" USB dirves. So new drives don't ever get added to my list of things to filter, and in fact the system doesn't even load drivers for them. So technically it's true that I'm not passing down any IRPs, because I'm not seeing them. Dennis Based upon the symptoms you're reporting, you're not passing down the PNP enumeration IRPs properly. It isn't clear to me where you want to be loaded. Are you trying to create a lower-level Function Filter Device Object (FFDO) or a Bus Filter Device Object (BFDO)? -Brian
|
Next
|
Last
Pages: 1 2 Prev: Virtual LPT/Parallel Port Emulation Software,... Next: USBSER.SYS INT Endpoint? |