OS shutdown notification in volume filter driver

Hi,

I have a volume filter driver that opens and holds a file while working. I need to close that file upon system shutdown. For that task I need a shutdown notification that comes in while the file system stack is still up and running (otherwise the file handle will become invalid).

What kind of notification can be used for this purpose? Thank you

On 06/20/13 01:47, xxxxx@gmail.com wrote:

Hi,

I have a volume filter driver that opens and holds a file while working. I need to close that file upon system shutdown. For that task I need a shutdown notification that comes in while the file system stack is still up and running (otherwise the file handle will become invalid).

What kind of notification can be used for this purpose? Thank you

Maybe this can help:
http://www.osronline.com/showthread.cfm?link=160066

[quote]
For that task I need a shutdown
notification that comes in while the file system stack is still up and running

You can determine this from the Set Power S-IRP that’s sent and the state information that accompanies it.

Peter
OSR

the guard, Peter,

Thank you for your answers. I’m now checking both IoRegisterShutdownNotification and Set Power S-IRP.

I have a question on the first one: how can I distinguish between IRP_MJ_SHUTDOWN sent as a result of IoRegisterShutdownNotification, and normal IRP_MJ_SHUTDOWN? I receive both and I need to do different work in each of them. Thank you

What does this mean? I mean according to IRP_MJ_SHUTDOWN documentation, you
shouldn’t receive it unless you have registered for it via
IoRegisterShutdownNotification. So what does ‘both’ mean here? or asking it
other way, what is the normal ‘IRP_MJ_SHUTDOWN’? ‘Normally’ your device can
receive shutdown notification thru IRP_MJ_POWER (provided it is a PnP
device). Is that the other one you are talking of?

On Thu, Jun 20, 2013 at 8:38 PM, wrote:

> the guard, Peter,
>
> Thank you for your answers. I’m now checking both
> IoRegisterShutdownNotification and Set Power S-IRP.
>
> I have a question on the first one: how can I distinguish between
> IRP_MJ_SHUTDOWN sent as a result of IoRegisterShutdownNotification, and
> normal IRP_MJ_SHUTDOWN? I receive both and I need to do different work in
> each of them. Thank you
>
> —
> NTDEV is sponsored by OSR
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

He’s a filter driver. I *assume* he means how he can differentiate between one targeted to HIM because he’s registered for shutdown notification and the IRP targeted to someone ELSE in the Dev Node (because THEY’VE registered for shutdown notification).

Assuming that’s the question (a big assumption, granted)… then the answer is “It doesn’t matter” – Shutdown for somebody else is shutdown for you.

Aside from that, I’ll repeat the advice I’ve already given: Specifically, in the storage stack, I’d be looking for the power transition. Things can get mighty confusing in the storage stack.

Peter
OSR

I think, the power irp might be too late to write anything through file system ?

How about creating a control device object and then calling IoRegisterShutdownNotification for the control device object ? This will be separate from all the SHUTDOWN you are getting for each of your volumes. From purely observation it gets called before shutdown to any of the volumes.

Atul, Peter, Pradeep,

Thank you for your answers.
For IRP_MJ_SHUTDOWN - I get two: first is the one that I’ve subscribed for, another is sent by FS driver.

The difference between them is that in the first one I can work with file handle, in the second file system is no longer available. That’s why I need to differentiate.

And yes, power IRP is too late to work with files too.

Pradeep, your suggestion makes lot of sense and I was thinking about it, it just has some technical problems to implement. For now I just stick with an assumption that the first IRP_MJ_SHUTDOWN is from notification routine, and the other is from FS driver. Seems to work, although I don’t quite like it.

Thank you