Hi,
I'm a newbie to Windows driver writing. To start learning
I have a filter driver that is to simply put an entry into
the Application log whenever an IRP passes through it,
then passes the IRP on. This is on Windows 2000 using a
removable USB disk (Linksys 32 MB 'solid state' instant
disk device).
My filter is installed as an Upper Filter to usbstor.sys.
When I attach the USB disk, my filter sees the DriverEntry
call, the AddDevice call, and sees IRP_MN_START_DEVICE,
properly placing an entry in the log. Also sees some more
IRPs that I have not specifically identified, but simply
have noted in the log as having been passed on. All of
these happen before I have tried to access anything on the
USB disk.
When I access the disk, the filter sees no IRP activity.
I would have thought I'd see some IRPs pass through during
disk reading/writing. Reading/writing of the disk is
successful. The filter next sees IRPs when I remove the
device.
So, given the successful disk reads/writes and the lack of
IRP activity detected by the filter during these
operations the filter must be bypassed by the reads and
writes?
What part of the picture am I missing here, and how do I
get my filter to see the read/write related IRPs? Is
there some part(s) of the DDK that I should review more
thoroughly to understand this? .. Or is it somewhere else
I should read? If the filter is indeed being bypassed by
reads/writes is this behavior strictly related to USB
(i.e. usbstor.sys) or is this a common part of port and/or
class driver operation?
Thanks for any help.
-alan