Dump_Write routine

The Dump_Write callback routine is called before the write to the dump port driver. The filter driver can access the dump data at this time.

Syntax


PDUMP_WRITE Dump_Write;

NTSTATUS Dump_Write(
  _In_     PFILTER_EXTENSION FilterExtension,
  _Inout_  PLARGE_INTEGER DiskByteOffset,
  _Inout_  PMDL Mdl
)
{ ... }

Parameters

FilterExtension [in]

A pointer to a FILTER_EXTENSION structure.

DiskByteOffset [in, out]

The value, in bytes, relative to the destination partition for the crash dump or hibernation. Filter drivers should not modify this field.

Mdl [in, out]

A pointer to an MDL structure that describes the data buffer. If the MDL is modified, the size of the write operation cannot change.

Return value

If the routine succeeds, it must return STATUS_SUCCESS. Otherwise, it must return one of the error status values defined in Ntstatus.h.

Remarks

Filter drivers can read the data that needs to be written. However, filter drivers cannot write to the buffer, as this could change the contents of the code or data that is being used by the crash dump process. Also, filter drivers are not allowed to change the size of the data.

To safely modify the data for the dump write, a filter driver should allocate a secondary buffer. The buffer's size will be the value of the MaxPagesPerWrite member of FILTER_INITIALIZATION_DATA multiplied by PAGE_SIZE. The data for the current buffer described by Mdl is copied into the secondary buffer and processed. After the filter is finished handling the dump data in the secondary buffer, the MDL pointed to by Mdl is updated with the address of the secondary buffer. The starting address of the secondary buffer set in the MDL must be page aligned.

Requirements

Version

Available starting with Windows Vista and Windows Server 2008.

Header

Ntdddump.h (include Ntdddump.h)

See also

Dump_Read
FILTER_EXTENSION
FILTER_INITIALIZATION_DATA

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft