I am observing a strange problem. I have some data that needs to be flushed
to a disk file just before VSS commits the snapshot. The setup:
0) Volume filter driver.
1) Driver has open file handle.
2) Driver sends FSCTL_MARK_HANDLE and locks the clusters from being moved.
3) Driver stores files retrieval pointers in device extension.
4) When the driver needs to read or write to/from the file, it is done via
IoBuildSynchronousFsdRequest() IRP_MJ_READ/WRITE from/to the appropriate
clusters on the volume below the filter (from a system thread). This is
working flawless until:
On IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES, before sending the IRP down to the
target, the driver does one last flush (waiting for the thread to finish),
and the writes to the target device fail with c0000225. They actually start
failing shortly after IOCTL_VOLSNAP_PREPARE_FOR_SNAPSHOT; just before
IOCTL_VOLSAP_FLUSH_AND_HOLD_WRITES. Everything is moving along fine, lots
of IO occurring via the filter, and then all of a sudden, the writes begin
I would expect the target under the filter to accept the write requests
since I have not sent the FLUSH_AND_HOLD_WRITES down yet. Isn't that sort
of the purpose of a flush? The reason for doing the direct cluster IO is to
avoid and locking issues with the file system precisely during
Am I missing something here? Shouldn't this work?