I’m register DriverUnload() routine in DriverEntry() of my filesystem minifilter,but when I reset my system (Windows XP SP3) DriverUnload() don’t call…Why?
What is to “reset” the system?
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
wrote in message news:xxxxx@ntfsd…
> I’m register DriverUnload() routine in DriverEntry() of my filesystem minifilter,but when I reset my system (Windows XP SP3) DriverUnload() don’t call…Why?
>
“reset” - shutdown and then start system;
A shutdown does not unload minifilters.
Bill Wandel
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Tuesday, July 24, 2012 2:06 AM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Minifilter unload
“reset” - shutdown and then start system;
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
Yes,thank Bill Wandel,I’m found in DDK : “Neither the PnP manager nor the I/O manager calls Unload routines at system shutdown time. A driver that must perform shutdown processing should register a DispatchShutdown routine.”
In this case one of the way - register IRP_MJ_SHUTDOWN routine…But from DispatchShutdown routine I can’t work with filesystem (I want to flush some information to file when system shutdown) ,because IRP_MJ_SHUTDOWN routine can call with IRQL = APC_LEVEL…
How I can solve this problem?
>routine I can’t work with filesystem (I want to flush some information to file when system
shutdown) ,because IRP_MJ_SHUTDOWN routine can call with IRQL = APC_LEVEL…
You can. Just create IRPs by IoAllocareIrp and send them down.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
Maxim S. Shatskih, I don’t understand you…
I register in minifilter IRP_MJ_SHUTDOWN routine and system call’s my DispatchShutdown when shutdown,what do you mean “…and send them down”??
What Maxim is trying to say is that instead of using, for example, FltQueryInformationFile (which is documented as being only callable at PASSIVE_LEVEL) you could for example call FltAllocateCallbackData to allocate a FLT_CALLBACK_DATA structure, populate the fields as for an IRP_MJ_QUERY_INFORMATION and then call FltPerformSynchronousIo, which is ok since both FltAllocateCallbackData and FltPerformSynchronousIo can be called at APC_LEVEL.
Thanks,
Alex.