Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Internals & Software Drivers||19-23 June 2023||Live, Online|
|Writing WDF Drivers||10-14 July 2023||Live, Online|
|Kernel Debugging||16-20 October 2023||Live, Online|
|Developing Minifilters||13-17 November 2023||Live, Online|
OSR Open Systems Resources, Inc.
wrote in message news:[email protected]
> Transactions are there for USERS of the NTFS file system, not for NTFS
itself. Thus, the registry uses it and Microsoft Update uses it.
Thanks for clarifying. The ntinsider article mentionned a log for filesystem
state so I may have been confused.
I try to get the model straigth. If a filter is interested to monitor file
system state changes (i.e.file deletion, attribute changes ...) and the
filtered file object is part of a transaction, it registers a callback
function and at some point pass the irp trhough.
If the transaction is aborted the callback is fired to let the filter do its
cleanup instead of the system sending a new irp or cancelling the irp?
This mechanism opens a new path in the filter and I can see a potential for
breaking lock hierarchy.
Does the framework has a way to prevent this ? (apc like)
Can this callback race with the irp completion ?
I couldn't seem to find all answers in the doc so far, Thanks for the time.
> Tony Mason
> Consulting Partner
> OSR Open Systems Resources, Inc.