none
How to pend a IO operation for special time such as 60 seconds by minifilter or other ways? RRS feed

  • Question

  • What I needed is supposing that I want to write some data to a file, then the IRPs(I/O request packets) is intercepted by the minifilter or other ways , and just pending it for 60 seconds by minifilter (such as by calling the code thread.sleep(6000) or any other ways to achieve pending 60 seconds) nothing else need to do, then release\signal the IRP and continue it's normally IRP workflow.

    How to implement this function? such sample code is appreciated. Thank you in advanced.




    • Edited by Jacky_shen Wednesday, April 27, 2016 3:50 AM
    Wednesday, April 27, 2016 3:46 AM

Answers

  • While in theory this is easy to do, by just calling KeDelayExecutionThread in the write handler, the system is very likely to have problems if you do this.  What is the purpose of this delay?  Could you take the data, and hold it while indicating that the data was written, then have a worker thread do the write in 60 seconds?

    Windows does not expect this sort of behavior, and putting a long delay in an I/O is going to cause problems.  Tell us the real goal of this effort, and we may be able to give a practical suggestion.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Jacky_shen Wednesday, April 27, 2016 12:58 PM
    Wednesday, April 27, 2016 10:40 AM
  • You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is.  You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread.   There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Jacky_shen Wednesday, April 27, 2016 12:58 PM
    Wednesday, April 27, 2016 12:36 PM

All replies

  • While in theory this is easy to do, by just calling KeDelayExecutionThread in the write handler, the system is very likely to have problems if you do this.  What is the purpose of this delay?  Could you take the data, and hold it while indicating that the data was written, then have a worker thread do the write in 60 seconds?

    Windows does not expect this sort of behavior, and putting a long delay in an I/O is going to cause problems.  Tell us the real goal of this effort, and we may be able to give a practical suggestion.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Jacky_shen Wednesday, April 27, 2016 12:58 PM
    Wednesday, April 27, 2016 10:40 AM
  • While in theory this is easy to do, by just calling KeDelayExecutionThread in the write handler, the system is very likely to have problems if you do this.  What is the purpose of this delay?  Could you take the data, and hold it while indicating that the data was written, then have a worker thread do the write in 60 seconds?

    Windows does not expect this sort of behavior, and putting a long delay in an I/O is going to cause problems.  Tell us the real goal of this effort, and we may be able to give a practical suggestion.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com


    Hi  Don,

    Thank you so much for your kindly help!

    In fact which I needed is just pending the IO write operation to a particular SQL Server database file instead of every IO operations , below is the story why I need this delay.

    Based on the article below, if SQL Server I/O requests taking longer than 15 seconds , then it would print an error log, what I needed is just repro this "15 seconds pending IO operation" for a particular database file like just the error mentioned in the article below to do a demo for this IO transfer performance issue. Also I just want to learn the driver development through some practical requirements.

    https://blogs.msdn.microsoft.com/sqlsakthi/2011/02/09/troubleshooting-sql-server-io-requests-taking-longer-than-15-seconds-io-stalls-disk-latency/

    To be honest, I learned windows drive development within a week,so my questions maybe native, however I really hope I can get the experts's help just like you, so I have the following questions,

    If we can control the pending for just one particular file, just like the database file, if it is how we limit to a particular file ,by file handle?

    If we can use the KeDelayExecutionThread  in the minifilter driver?

    Any sample can be provided to implement my requirements?

    Thank you again in advanced.



    • Edited by Jacky_shen Wednesday, April 27, 2016 12:39 PM
    Wednesday, April 27, 2016 12:22 PM
  • You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is.  You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread.   There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    • Marked as answer by Jacky_shen Wednesday, April 27, 2016 12:58 PM
    Wednesday, April 27, 2016 12:36 PM
  • You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is.  You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread.   There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Thank you Don,

    BTW, Where the KeDelayExecutionThread should be called? in DriverEntry Routine ,Preoperation  or Postoperation Callback Routines of the minifliter drive or other place?

    Wednesday, April 27, 2016 12:46 PM
  • In the preoperation callback for the write to the file you have identified.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Wednesday, April 27, 2016 12:53 PM
  • In the preoperation callback for the write to the file you have identified.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com


    Thank you so much for your kindly help.
    Wednesday, April 27, 2016 12:58 PM
  • You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is.  You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread.   There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Don ,

    For "You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread"

    If the database file is already exist instead of created by we, and also the write to the that database file is control by the other service such as the SQL Server  ,which writes the data to database file automatically ,and the write cannot be controlled by me , for such situation I also can use that way (IRP_MJ_CREATE +context +KeDelayExecutionThread)  to control the write IO pending to the database file written by the SQL Server ?




    • Edited by Jacky_shen Wednesday, April 27, 2016 1:19 PM
    Wednesday, April 27, 2016 1:11 PM
  • Yes the mini-filter will see all operations of all processes.  Take the minispy WDK sample, build and install it.  The sample gives you a log of operations.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Wednesday, April 27, 2016 1:17 PM
  • Yes the mini-filter will see all operations of all processes.  Take the minispy WDK sample, build and install it.  The sample gives you a log of operations.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com


    Really appreciate for your kindly help.
    Wednesday, April 27, 2016 1:20 PM
  • You can control the pending of one file, by catching the IRP_MJ_CREATE you can detect what file it is.  You add a context to the file and then in the write calls, you can check for the context and issue the KeDelayExecutionThread.   There are no samples for something like this, as I said it is a pretty weird requirement, you should be able to use one of the minifilter samples from the WDK as a starting point.


    Don Burn Windows Driver Consulting Website: http://www.windrvr.com

    Hi Don,

    I still have some other questions,

    1,Why we need to catch the  IRP_MJ_CREATE to detect what file it is ,why not detect it from the IRP_MJ_WRITE directly? as I just need to pend the write operation.

    2,What's the "context to the file"? It is refer to the FsContext pointer value to file objects mentioned by the article below or other structure?

    https://msdn.microsoft.com/en-us/library/windows/hardware/ff540359(v=vs.85).aspx

    3,Why we need to add context to the file ? it means we just can get the file name from the context ?

    4,How to add context to the file, any exists windows API can be used ?

    Sorry for my naive questions and hope can get your help again.

    Thursday, April 28, 2016 7:12 AM
  • You're making a minifilter (not a legacy file system filter), so use the functions listed in Managing Contexts.
    Friday, April 29, 2016 7:38 PM