The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I have a volume UpperFilter driver that captures IRP_MJ_WRITE buffer contents that are coming down from NTFS to the volume. I'm making a copy of the write data in my dispatch routine, using MmGetSystemAddressForMdlSafe(pIrp->MdlAddress, NormalPagePriority) to get a pointer to the data.
Occasionally, under heavy load, I see that the system buffer returned by MmGetSystemAddressForMdlSafe contains different data than what actually gets committed to the volume.
I know that, with Direct I/O, it's possible that the user can change the buffer contents while it's being sent. I'm assuming that's what is happening here - NTFS is constructing the buffer after initiating the write request, and we're seeing the data before it is finalized. If that's true, then there must be some mechanism that NTFS uses to notify the disk driver that the data is complete and ready to be committed.
Assuming that's all correct, is there some way that our filter driver can use the same mechanism to wait for the buffer to be complete? Or am I off base with my analysis?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!|
|Writing WDF Drivers||24 January 2022||Live, Online|
|Internals & Software Drivers||7 February 2022||Live, Online|
|Kernel Debugging||21 March 2022||Live, Online|
|Developing Minifilters||23 May 2022||Live, Online|