Hello all,
I have a minifilter that receives all IRP_MJ_CREATE requests and send some information to a userspace program and wait a response. The operation is just complete after the response, which can contain information to deny or not the operation.
When I shutdown then computer, the userspace app is finished, but, the minifilter continue sending data to userspace (and waiting a response). In this point the system hangs.
How can I know when the system is about to shutdown to stop the communication to userspace?
You might want to use a timeout when waiting for the user mode connection
otherwise if your process dies for whatever reason it will hang the system
anyway…
Also, what you want is probably IRP_MJ_SHUTDOWN. Since you’re a minifilter
you shouldn’t need to call IoRegisterShutdownNotification. All you should do
is register a callback for it (IIRC).
Thanks,
Alex.
Thaks for response Alex,
My userspace program should be up all time, and, if it is killed, I wish that the system hangs.
but I have tried IRP_MJ_SHUTDOWN, but without success.
When IRP_MJ_SHUTDOWN is called? Before or after the kill of the userspace apps?
What I need is a notification on shutdown just to close the comm port (driver or user app) before the kill to my app.
Regards.
Not sure when IRP_MJ_SHUTDOWN is getting called, never used it myself…
You can wait on the process and it will get signaled when the process
terminates…
Thanks,
Alex.
Normally, communication between a user app and a minifilter go over a
communication port. If the reference count of the communication port goes
down to zero, because the app closes the port or terminates the
DisconnectNotifyCallback routine will get called, which was specified when
you called FltCreateCommunicationPort. Whether or not shutdown, this is
where your minifilter can know when to stop sending messages.
//Daniel
wrote in message news:xxxxx@ntfsd…
> Hello all,
>
> I have a minifilter that receives all IRP_MJ_CREATE requests and send some
> information to a userspace program and wait a response. The operation is
> just complete after the response, which can contain information to deny or
> not the operation.
>
> When I shutdown then computer, the userspace app is finished, but, the
> minifilter continue sending data to userspace (and waiting a response). In
> this point the system hangs.
>
> How can I know when the system is about to shutdown to stop the
> communication to userspace?
>
IRP_MJ_SHUTDOWN is used at several different points in the shutdown process. There’s an early shutdown that goes to non-storage drivers. There’s a late shutdown that goes to the file systems (and I think they added a third call after that for storage drivers sticking around at that point.) The idea here is pretty simple - you want to shut down the storage stack late, since anything that happens after the storage stack is shut down is non-persistent (NTFS, for example, returns STATUS_TOO_LATE for operations after shutdown, a trick I’ve exploited in filter drivers from time to time - just remember, all the data is lost at that point.)
Filter drivers observe the IRP_MJ_SHUTDOWN late (because they see the shutdown sent to their file system driver) but can also register for explicit callback - IoRegisterShutdownNotification (which gives you the early notification) or IoRegisterLastChanceShutdownNotification (which is the late one, *after* the FSD shutdowns have been sent.)
Tony
The OP still needs his filter to handle other situations in which he
unexpectedly loses contact which his app, such as a spontaneous process
termination so I think only a DisconnectNotifyCallback is useful here.
//Daniel
“Tony Mason” wrote in message news:xxxxx@ntfsd…
> IRP_MJ_SHUTDOWN is used at several different points in the shutdown
> process. There’s an early shutdown that goes to non-storage drivers.
> There’s a late shutdown that goes to the file systems (and I think they
> added a third call after that for storage drivers sticking around at that
> point.) The idea here is pretty simple - you want to shut down the
> storage stack late, since anything that happens after the storage stack is
> shut down is non-persistent (NTFS, for example, returns STATUS_TOO_LATE
> for operations after shutdown, a trick I’ve exploited in filter drivers
> from time to time - just remember, all the data is lost at that point.)
>
> Filter drivers observe the IRP_MJ_SHUTDOWN late (because they see the
> shutdown sent to their file system driver) but can also register for
> explicit callback - IoRegisterShutdownNotification (which gives you the
> early notification) or IoRegisterLastChanceShutdownNotification (which is
> the late one, after the FSD shutdowns have been sent.)
>
> Tony
>
>
Hi all,
sorry for the delay in responding. I resolved my problem in userspace, handling the shutdown and disconnection from minifilter.
Thanks for all responses.
Samuel Feitosa