Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Monthly Seminars at OSR Headquarters

East Coast USA
Windows Internals and SW Drivers, Dulles (Sterling) VA, 9 April 2018

Writing WDF Drivers I: Core Concepts, Manchester, NH, 7 May 2018

Kernel Debugging & Crash Analysis for Windows, Manchester, NH, 21 May 2018


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 5  
06 Apr 18 01:33
trencan
xxxxxx@centrum.cz
Join Date: 29 Jun 2011
Posts To This List: 65
Device node parent

Hello, is there WDM API function to obtain parent device node in kernel mode? I know that _DEVICE_NODE->Parent points to parent node, but _DEVICE_NODE isn't officially documented. For KMDF there is WdfPdoGetParent available and for user mode CM_Get_Parent. In portingtables.doc (Summary of KMDF and WDM Equivalents) there is no WDM equivalent for WdfPdoGetParent. So is there really no way how to get it? Thanks.
  Message 2 of 5  
06 Apr 18 02:33
Doron Holan
xxxxxx@microsoft.com
Join Date: 08 Sep 2005
Posts To This List: 10195
Device node parent

If you are the bus driver, you track the parent FDO in the child PDO device extension. From a function or filter FDO, there is no way to query for the parent device higher in the tree. What bigger problem are you trying to solve? d -----Original Message----- From: xxxxx@lists.osr.com <xxxxx@lists.osr.com> On Behalf Of xxxxx@centrum.cz Sent: Thursday, April 5, 2018 10:33 PM To: Windows System Software Devs Interest List <xxxxx@lists.osr.com> Subject: [ntdev] Device node parent Hello, is there WDM API function to obtain parent device node in kernel mode? I know that _DEVICE_NODE->Parent points to parent node, but _DEVICE_NODE isn't officially documented. For KMDF there is WdfPdoGetParent available and for user mode CM_Get_Parent. In portingtables.doc (Summary of KMDF and WDM Equivalents) there is no WDM equivalent for WdfPdoGetParent. So is there really no way how to get it? Thanks. --- NTDEV is sponsored by OSR Visit the list online at: <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osronline.co m%2Fshowlists.cfm%3Flist%3Dntdev&data=02%7C01%7CDoron.Holan%40microsoft.com%7C941 a1f910ce54c6f16e708d59b7fed3f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636585 896099296849&sdata=%2FlLMVoPHSGs%2Bx2n8cj06ymLJ6PWEvtHSlsqg7Riw%2F4c%3D&reserved= 0> MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osr.com%2Fse minars&data=02%7C01%7CDoron.Holan%40microsoft.com%7C941a1f910ce54c6f16e708d59b7fe d3f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636585896099296849&sdata=fuFBleH n7aFJ8ywlV4imKiqfyrPcyXpuBt8hO%2BUoeaQ%3D&reserved=0> To unsubscribe, visit the List Server section of OSR Online at <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.osronline.co m%2Fpage.cfm%3Fname%3DListServer&data=02%7C01%7CDoron.Holan%40microsoft.com%7C941 a1f910ce54c6f16e708d59b7fed3f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636585 896099296849&sdata=fIAQ71tdD5u1dGQd6c5CbME3%2By3lpNVUKiZG6HH6EX4%3D&reserved=0>
  Message 3 of 5  
06 Apr 18 02:52
trencan
xxxxxx@centrum.cz
Join Date: 29 Jun 2011
Posts To This List: 65
Device node parent

We have more use cases for parent PDO: - One is for example we need to know if disk device is removable, so we look at its parent PDO and check for removable flag in DO. - Other use case is we need to detect kernel streaming proxy device stack, so we register our device filter driver in MEDIA device class and we know that parent PDO of PDO in kernel streaming proxy stack implements "KSNAME_Server" interface. We are attached to kernel streaming proxy stack by Windows and we need to query its parent PDO for that interface.
  Message 4 of 5  
06 Apr 18 13:22
Tim Roberts
xxxxxx@probo.com
Join Date: 28 Jan 2005
Posts To This List: 11894
Device node parent

xxxxx@centrum.cz wrote: > We have more use cases for parent PDO: > ... > - Other use case is we need to detect kernel streaming proxy device stack, so we register our device filter driver in MEDIA device class and we know that parent PDO of PDO in kernel streaming proxy stack implements "KSNAME_Server" interface. We are attached to kernel streaming proxy stack by Windows and we need to query its parent PDO for that interface. You're going to have to explain that one to me, because there are things here that don't make sense. I've been doing KS for 20 years, but I've never heard of a "kernel streaming proxy device".  The phrase "kernel streaming proxy" refers to the user-mode ksproxy.ax DLL that connects a KS driver to DirectShow. You are using the phrase "device filter driver," but each of those terms has multiple meanings.  The term "filter" in kernel streaming refers to the top-level objects that KS driver implement.  The driver exposes "filters", and each "filter" contains "pins", which do the real work.  That meaning is unrelated to the term "filter driver" as used in WDM device stacks.  Which one do you mean here?  If you have a driver in MEDIA device class, then you have an FDO, and you are not a filter driver.  In that case, you can certainly get the PDO for your FDO.  AVStream tracks that, and you need it to submit I/O requests to your hardware.  But, that driver is not going to be another KS driver. I hope you can enlighten me about your real architecture. -- Tim Roberts, xxxxx@probo.com Providenza & Boekelheide, Inc.
  Message 5 of 5  
09 Apr 18 04:54
trencan
xxxxxx@centrum.cz
Join Date: 29 Jun 2011
Posts To This List: 65
Device node parent

By filter driver I mean "filter driver" as used in WDM. It is registered in MEDIA device class as UpperFilter and it is attached to device stacks of MEDIA devices. Purpose of our driver is to control application's access to camera device. We can be registered in new Camera device class introduced since Win10 RS3, but then we always see requests coming from svchost.exe. We need to know real process (application) accessing camera. When we are as upper filter driver above device "SW\{96E080C7-143C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} " then we see real processes accessing camera. Here is output of !devnode 0 1: DevNode 0x84d6fe28 for PDO 0x84d70d30 InstancePath is "ROOT\SYSTEM\0000" ServiceName is "swenum" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) DevNode 0xbc5d89d0 for PDO 0xb2249a30 InstancePath is "SW\{96E080C7-143C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} " ServiceName is "MSKSSRV" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCompletion (0x30d) Driver mskssrv.sys is "Microsoft Streaming Service Proxy". Our filter driver registered in MEDIA device class is attached by Windows to device stack where MSKSSRV is functional driver. We had idea to detect it via its parent device node (where swenum is functional driver) implementing KSNAME_Server interface.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 08:24.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license