Windows 2000/XP SCSI filter driver

I’m trying to build a Windows 2000/XP filter driver that filters all traffic
on a particular SCSI (or IDE) bus. I started with the “toaster” filter
driver sample, and added code to do a DebugPrint() for every IRP the filter
driver sees. I set the filter driver up as an upper filter on top of
aic78xx.sys (or atapi.sys) for the bus I want to filter.

The driver loads fine, and I think I am seeing all the PnP IRPs. And if I
open \Device\ScsiPort1 and talk to a device on that SCSI bus, I can see all
the IRPs I send to that device. But if I do a disk read/write to a disk on
that SCSI bus, I see nothing.

Am I missing something? I did set the start type to SERVICE_BOOT_START and
the load order group to “SCSI miniport” (is that still necessary with a PnP
driver?). Has disk.sys already hooked into aic78xx.sys by the time my
filter driver loads? How do I do this?

Thank you!

-Dan

Dan Germann
xxxxx@nospam.visi.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Do you intercept the INTERNAL_DEVICE_CONTROL IRP?

----- Original Message -----
From: “Daniel E. Germann”
To: “NT Developers Interest List”
Sent: Monday, January 21, 2002 10:23 AM
Subject: [ntdev] Windows 2000/XP SCSI filter driver

> I’m trying to build a Windows 2000/XP filter driver that filters all traffic
> on a particular SCSI (or IDE) bus. I started with the “toaster” filter
> driver sample, and added code to do a DebugPrint() for every IRP the filter
> driver sees. I set the filter driver up as an upper filter on top of
> aic78xx.sys (or atapi.sys) for the bus I want to filter.
>
> The driver loads fine, and I think I am seeing all the PnP IRPs. And if I
> open \Device\ScsiPort1 and talk to a device on that SCSI bus, I can see all
> the IRPs I send to that device. But if I do a disk read/write to a disk on
> that SCSI bus, I see nothing.
>
> Am I missing something? I did set the start type to SERVICE_BOOT_START and
> the load order group to “SCSI miniport” (is that still necessary with a PnP
> driver?). Has disk.sys already hooked into aic78xx.sys by the time my
> filter driver loads? How do I do this?
>
> Thank you!
>
> -Dan
> –
> Dan Germann
> xxxxx@nospam.visi.com
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@setengineering.com
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Yeah, you are missing the fact that the scsiport driver is a bus driver, so
the FDO you are filtering is the bus driver FDO, while data is (generally)
targeted at the PDO’s managed by the bus driver, not the FDO. You either
have to figure out how to implement the undocumented bus filter driver, or
do the documented but ridiculous thing of being a lower filter driver for
all of the possible FDO’s that can be configured on top of the scsi pdos.

-----Original Message-----
From: Daniel E. Germann [mailto:xxxxx@nospam.visi.com]
Sent: Monday, January 21, 2002 12:24 PM
To: NT Developers Interest List
Subject: [ntdev] Windows 2000/XP SCSI filter driver

I’m trying to build a Windows 2000/XP filter driver that
filters all traffic on a particular SCSI (or IDE) bus. I
started with the “toaster” filter driver sample, and added
code to do a DebugPrint() for every IRP the filter driver
sees. I set the filter driver up as an upper filter on top
of aic78xx.sys (or atapi.sys) for the bus I want to filter.

The driver loads fine, and I think I am seeing all the PnP
IRPs. And if I open \Device\ScsiPort1 and talk to a device
on that SCSI bus, I can see all the IRPs I send to that
device. But if I do a disk read/write to a disk on that SCSI
bus, I see nothing.

Am I missing something? I did set the start type to
SERVICE_BOOT_START and the load order group to “SCSI
miniport” (is that still necessary with a PnP driver?). Has
disk.sys already hooked into aic78xx.sys by the time my
filter driver loads? How do I do this?

Thank you!

-Dan

Dan Germann
xxxxx@nospam.visi.com


You are currently subscribed to ntdev as:
xxxxx@stratus.com To unsubscribe send a blank email to
leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> Am I missing something? I did set the start type to SERVICE_BOOT_START and

the load order group to “SCSI miniport” (is that still necessary with a PnP
driver?). Has disk.sys already hooked into aic78xx.sys by the time my
filter driver loads? How do I do this?

On w2k/XP, SCSIPORT is a WDM bus driver.

It has a FDO for HBA and several PDOs hanging off it for each LUN.
Your filter attaches itself to HBA PDO, while the disk driver attaches as a PnP functional driver to the LUN PDO.

Max


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Hi Damiel,

Maybe you’ll try to write SCSI filter driver? That sits over the SCSI class
driver? And intercept requests on per-device not per-storage bus driver
basis?
There are samples of storage filter drivers in DDK.

Regards,
Anton

On 01/21/02, ““Daniel E. Germann” ” wrote:
> I’m trying to build a Windows 2000/XP filter driver that filters all traffic
> on a particular SCSI (or IDE) bus. I started with the “toaster” filter
> driver sample, and added code to do a DebugPrint() for every IRP the filter
> driver sees. I set the filter driver up as an upper filter on top of
> aic78xx.sys (or atapi.sys) for the bus I want to filter.
>
> The driver loads fine, and I think I am seeing all the PnP IRPs. And if I
> open \Device\ScsiPort1 and talk to a device on that SCSI bus, I can see all
> the IRPs I send to that device. But if I do a disk read/write to a disk on
> that SCSI bus, I see nothing.
>
> Am I missing something? I did set the start type to SERVICE_BOOT_START and
> the load order group to “SCSI miniport” (is that still necessary with a PnP
> driver?). Has disk.sys already hooked into aic78xx.sys by the time my
> filter driver loads? How do I do this?
>
> Thank you!
>
> -Dan
> –
> Dan Germann
> xxxxx@nospam.visi.com
>
>
> —
> You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
> To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

Many thanks to Gera, Mark, Max and Anton for their replies.

I guess I misunderstood the anecdote at the end of chapter 11 of the OSR
book (SCSI port driver read-only filter). It sounds like you can’t do what
they’re talking about in the Windows 2000/XP PnP world. (Are there any
plans to update the book for Windows 2000/XP and WDM? :wink: That would be
GREAT!)

It looks like I am in for a lot of fun. Here’s the problem. I have a
laptop that will plug into the SCSI busses of target systems with varying
disk hardware for diagnostic and instrumentation purposes. I must make 100%
sure that the laptop accesses the hardware on the SCSI bus in READ-ONLY
mode. So, no filesystem mounting, no updating “dirty” bits, etc. The
laptop will inspect data on the target system and display various statistics
and reports. My idea was that if I inserted a filter driver on top of the
SCSI port driver, that all I/O requests on the bus would get filtered (after
all, I thought, wouldn’t disk.sys end up sending IRPs to aic78xx.sys to do
the disk I/O?). Evidently, I completely misunderstood how all this works.

So, if I am understanding correctly now, I will have to add a lower filter
driver on disk.sys (to catch “normal” I/O) and keep my upper filter driver
on aic78xx.sys (to catch \Device\ScsiPortx I/O).

One more question: how do I ensure that *all* disks the laptop ever sees
(except, of course, my system disk) get filtered automatically? If I
install an .INF file for my filter driver that references hardware ID
“GenDisk”, I think it will work. But my concern is that the field engineers
using the diagnostic software on the laptops aren’t necessarily the most
technically aware users. If they see an Add New Hardware dialog when they
plug into a new target system, they’ll probably get confused and tell it to
install the standard disk driver – and I’ll lose my read-only filter.

-Dan

Dan Germann
xxxxx@nospam.visi.com

-----Original Message-----
Subject: RE: Windows 2000/XP SCSI filter driver
From: “Roddy, Mark”
> Date: Mon, 21 Jan 2002 13:12:55 -0500
> X-Message-Number: 23
>
> Yeah, you are missing the fact that the scsiport driver is a bus
> driver, so
> the FDO you are filtering is the bus driver FDO, while data is (generally)
> targeted at the PDO’s managed by the bus driver, not the FDO. You either
> have to figure out how to implement the undocumented bus filter driver, or
> do the documented but ridiculous thing of being a lower filter driver for
> all of the possible FDO’s that can be configured on top of the scsi pdos.
>
> > -----Original Message-----
> > From: Daniel E. Germann [mailto:xxxxx@nospam.visi.com]
> > Sent: Monday, January 21, 2002 12:24 PM
> > To: NT Developers Interest List
> > Subject: [ntdev] Windows 2000/XP SCSI filter driver
> >
> >
> > I’m trying to build a Windows 2000/XP filter driver that
> > filters all traffic on a particular SCSI (or IDE) bus. I
> > started with the “toaster” filter driver sample, and added
> > code to do a DebugPrint() for every IRP the filter driver
> > sees. I set the filter driver up as an upper filter on top
> > of aic78xx.sys (or atapi.sys) for the bus I want to filter.
> >
> > The driver loads fine, and I think I am seeing all the PnP
> > IRPs. And if I open \Device\ScsiPort1 and talk to a device
> > on that SCSI bus, I can see all the IRPs I send to that
> > device. But if I do a disk read/write to a disk on that SCSI
> > bus, I see nothing.
> >
> > Am I missing something? I did set the start type to
> > SERVICE_BOOT_START and the load order group to “SCSI
> > miniport” (is that still necessary with a PnP driver?). Has
> > disk.sys already hooked into aic78xx.sys by the time my
> > filter driver loads? How do I do this?
> >
> > Thank you!
> >
> > -Dan
> > –
> > Dan Germann
> > xxxxx@nospam.visi.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You can also write your own class driver that loads very early and
simply claims all the devices so that no other class driver (disk, tape,
cd-rom, etc…) will be able to claim the devices. Then you provide your
own IOCTL interface to the class driver to perform the specific tasks
you need to perform on the devices; diagnostics, etc…

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daniel E. Germann
Sent: Tuesday, January 22, 2002 9:21 AM
To: NT Developers Interest List
Subject: [ntdev] RE: Windows 2000/XP SCSI filter driver

Many thanks to Gera, Mark, Max and Anton for their replies.

I guess I misunderstood the anecdote at the end of chapter 11 of the OSR
book (SCSI port driver read-only filter). It sounds like you can’t do
what they’re talking about in the Windows 2000/XP PnP world. (Are there
any plans to update the book for Windows 2000/XP and WDM? :wink: That
would be
GREAT!)

It looks like I am in for a lot of fun. Here’s the problem. I have a
laptop that will plug into the SCSI busses of target systems with
varying disk hardware for diagnostic and instrumentation purposes. I
must make 100% sure that the laptop accesses the hardware on the SCSI
bus in READ-ONLY mode. So, no filesystem mounting, no updating “dirty”
bits, etc. The laptop will inspect data on the target system and
display various statistics and reports. My idea was that if I inserted
a filter driver on top of the SCSI port driver, that all I/O requests on
the bus would get filtered (after all, I thought, wouldn’t disk.sys end
up sending IRPs to aic78xx.sys to do the disk I/O?). Evidently, I
completely misunderstood how all this works.

So, if I am understanding correctly now, I will have to add a lower
filter driver on disk.sys (to catch “normal” I/O) and keep my upper
filter driver on aic78xx.sys (to catch \Device\ScsiPortx I/O).

One more question: how do I ensure that *all* disks the laptop ever sees
(except, of course, my system disk) get filtered automatically? If I
install an .INF file for my filter driver that references hardware ID
“GenDisk”, I think it will work. But my concern is that the field
engineers using the diagnostic software on the laptops aren’t
necessarily the most technically aware users. If they see an Add New
Hardware dialog when they plug into a new target system, they’ll
probably get confused and tell it to install the standard disk driver –
and I’ll lose my read-only filter.

-Dan

Dan Germann
xxxxx@nospam.visi.com

-----Original Message-----
Subject: RE: Windows 2000/XP SCSI filter driver
From: “Roddy, Mark”
> Date: Mon, 21 Jan 2002 13:12:55 -0500
> X-Message-Number: 23
>
> Yeah, you are missing the fact that the scsiport driver is a bus
> driver, so the FDO you are filtering is the bus driver FDO, while data

> is (generally) targeted at the PDO’s managed by the bus driver, not
> the FDO. You either have to figure out how to implement the
> undocumented bus filter driver, or do the documented but ridiculous
> thing of being a lower filter driver for all of the possible FDO’s
> that can be configured on top of the scsi pdos.
>
> > -----Original Message-----
> > From: Daniel E. Germann [mailto:xxxxx@nospam.visi.com]
> > Sent: Monday, January 21, 2002 12:24 PM
> > To: NT Developers Interest List
> > Subject: [ntdev] Windows 2000/XP SCSI filter driver
> >
> >
> > I’m trying to build a Windows 2000/XP filter driver that filters all

> > traffic on a particular SCSI (or IDE) bus. I started with the
> > “toaster” filter driver sample, and added code to do a DebugPrint()
> > for every IRP the filter driver sees. I set the filter driver up as

> > an upper filter on top of aic78xx.sys (or atapi.sys) for the bus I
> > want to filter.
> >
> > The driver loads fine, and I think I am seeing all the PnP IRPs.
> > And if I open \Device\ScsiPort1 and talk to a device on that SCSI
> > bus, I can see all the IRPs I send to that device. But if I do a
> > disk read/write to a disk on that SCSI bus, I see nothing.
> >
> > Am I missing something? I did set the start type to
> > SERVICE_BOOT_START and the load order group to “SCSI miniport” (is
> > that still necessary with a PnP driver?). Has disk.sys already
> > hooked into aic78xx.sys by the time my filter driver loads? How do
> > I do this?
> >
> > Thank you!
> >
> > -Dan
> > –
> > Dan Germann
> > xxxxx@nospam.visi.com


You are currently subscribed to ntdev as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I don’t think that really works for pnp. As soon as scsiport declares a PDO
of type GenericDisk, for example, the pnp system will go fetch the diskclass
driver to provide an FDO for it, no matter how early you load your private
class driver.

He has to either be a lower filter driver for disk, tape, whatever, or be a
bus driver pdo filter driver. I prefer the latter approach as, despite the
fact that it is undocumented, it is really the only good way to cover all
possible scsi-enumerated devices.

-----Original Message-----
From: Jamey Kirby [mailto:xxxxx@storagecraft.com]
Sent: Tuesday, January 22, 2002 12:45 PM
To: NT Developers Interest List
Subject: [ntdev] RE: Windows 2000/XP SCSI filter driver

You can also write your own class driver that loads very
early and simply claims all the devices so that no other
class driver (disk, tape, cd-rom, etc…) will be able to
claim the devices. Then you provide your own IOCTL interface
to the class driver to perform the specific tasks you need to
perform on the devices; diagnostics, etc…

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Daniel E. Germann
Sent: Tuesday, January 22, 2002 9:21 AM
To: NT Developers Interest List
Subject: [ntdev] RE: Windows 2000/XP SCSI filter driver

Many thanks to Gera, Mark, Max and Anton for their replies.

I guess I misunderstood the anecdote at the end of chapter 11
of the OSR book (SCSI port driver read-only filter). It
sounds like you can’t do what they’re talking about in the
Windows 2000/XP PnP world. (Are there any plans to update
the book for Windows 2000/XP and WDM? :wink: That would be
GREAT!)

It looks like I am in for a lot of fun. Here’s the problem.
I have a laptop that will plug into the SCSI busses of target
systems with varying disk hardware for diagnostic and
instrumentation purposes. I must make 100% sure that the
laptop accesses the hardware on the SCSI bus in READ-ONLY
mode. So, no filesystem mounting, no updating “dirty” bits,
etc. The laptop will inspect data on the target system and
display various statistics and reports. My idea was that if
I inserted a filter driver on top of the SCSI port driver,
that all I/O requests on the bus would get filtered (after
all, I thought, wouldn’t disk.sys end up sending IRPs to
aic78xx.sys to do the disk I/O?). Evidently, I completely
misunderstood how all this works.

So, if I am understanding correctly now, I will have to add a
lower filter driver on disk.sys (to catch “normal” I/O) and
keep my upper filter driver on aic78xx.sys (to catch
\Device\ScsiPortx I/O).

One more question: how do I ensure that *all* disks the
laptop ever sees (except, of course, my system disk) get
filtered automatically? If I install an .INF file for my
filter driver that references hardware ID “GenDisk”, I think
it will work. But my concern is that the field engineers
using the diagnostic software on the laptops aren’t
necessarily the most technically aware users. If they see an
Add New Hardware dialog when they plug into a new target
system, they’ll probably get confused and tell it to install
the standard disk driver – and I’ll lose my read-only filter.

-Dan

Dan Germann
xxxxx@nospam.visi.com

> -----Original Message-----
> Subject: RE: Windows 2000/XP SCSI filter driver
> From: “Roddy, Mark”
> > Date: Mon, 21 Jan 2002 13:12:55 -0500
> > X-Message-Number: 23
> >
> > Yeah, you are missing the fact that the scsiport driver is a bus
> > driver, so the FDO you are filtering is the bus driver FDO,
> while data
>
> > is (generally) targeted at the PDO’s managed by the bus driver, not
> > the FDO. You either have to figure out how to implement the
> > undocumented bus filter driver, or do the documented but ridiculous
> > thing of being a lower filter driver for all of the possible FDO’s
> > that can be configured on top of the scsi pdos.
> >
> > > -----Original Message-----
> > > From: Daniel E. Germann [mailto:xxxxx@nospam.visi.com]
> > > Sent: Monday, January 21, 2002 12:24 PM
> > > To: NT Developers Interest List
> > > Subject: [ntdev] Windows 2000/XP SCSI filter driver
> > >
> > >
> > > I’m trying to build a Windows 2000/XP filter driver that
> filters all
>
> > > traffic on a particular SCSI (or IDE) bus. I started with the
> > > “toaster” filter driver sample, and added code to do a
> DebugPrint()
> > > for every IRP the filter driver sees. I set the filter
> driver up as
>
> > > an upper filter on top of aic78xx.sys (or atapi.sys) for the bus I
> > > want to filter.
> > >
> > > The driver loads fine, and I think I am seeing all the PnP IRPs.
> > > And if I open \Device\ScsiPort1 and talk to a device on that SCSI
> > > bus, I can see all the IRPs I send to that device. But if I do a
> > > disk read/write to a disk on that SCSI bus, I see nothing.
> > >
> > > Am I missing something? I did set the start type to
> > > SERVICE_BOOT_START and the load order group to “SCSI
> miniport” (is
> > > that still necessary with a PnP driver?). Has disk.sys already
> > > hooked into aic78xx.sys by the time my filter driver
> loads? How do
> > > I do this?
> > >
> > > Thank you!
> > >
> > > -Dan
> > > –
> > > Dan Germann
> > > xxxxx@nospam.visi.com
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@storagecraft.com To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@stratus.com To unsubscribe send a blank email to
> leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

“Daniel E. Germann” wrote in message
news:xxxxx@ntdev…
>
> (Are there any
> plans to update the book for Windows 2000/XP and WDM? :wink: That would be
> GREAT!)
>

Think “Longhorn”, my friend…

Peter
OSR


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com