Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Kernel Debugging | 13-17 May 2024 | Live, Online |
Developing Minifilters | 1-5 Apr 2024 | Live, Online |
Internals & Software Drivers | 11-15 Mar 2024 | Live, Online |
Writing WDF Drivers | 26 Feb - 1 Mar 2024 | Live, Online |
Comments
that they hang? Or are you saying that they do a data transfer that is
different than requested? If it is the former, what do you see when you
look at the stack in the debugger? If it is the latter, how much data
do they transfer and what status do they return?
Is this to your own file system? If so, my suggestion is that you have
a bug in your file system. If not, I'd want to understand how you are
using CcCopyRead/CcCopyWrite (since they really should only be used by
the owner of the cache.)
Tony
OSR
You must own the FCB before calling these functions.
From: [email protected]
[mailto:[email protected]] On Behalf Of Tony Mason
Sent: Wednesday, August 13, 2008 5:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] CcCopyRead and CcCopyWrite don't finish if Length in
bytes of the data is 0x80000 (512 KB) on Windows Vista
What does it mean when you say that they "don't finish". Are you saying
that they hang? Or are you saying that they do a data transfer that is
different than requested? If it is the former, what do you see when you
look at the stack in the debugger? If it is the latter, how much data do
they transfer and what status do they return?
Is this to your own file system? If so, my suggestion is that you have a
bug in your file system. If not, I'd want to understand how you are using
CcCopyRead/CcCopyWrite (since they really should only be used by the owner
of the cache.)
Tony
OSR
---
NTFSD is sponsored by OSR
For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''
To unsubscribe send a blank email to [email protected]
Cheers,
Gabriel
The latter is wrong.
Exclusive acquisition of FCB is only done for a write which increases the file
size.
Exclusive acquisiton of paging IO resource is only done in truncation path.
Anyway these fields are not intended to be accessed from filters. The FSD owns
them.
--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
[email protected]
http://www.storagecraft.com
"these fields are not intended to be accessed from filters. The FSD owns
them."
If you assume you know what the underlying file system's locking model
is, you're broken. If possible, at least restrict your broken software
to working with a single file system - that way the fact you are broken
is less likely to leak out.
Note: there is NO requirement that an FSD use either of these resources.
There are flags that indicate (for FsRtl's benefit) which resources ARE
used, but the locking callbacks have been added to give the file system
greater flexibility in building locking models. Outside FsRtl (which
explicitly requires a format to use its functions) ANY component that
reaches into FileObject->FsContext and assumes it knows the format of
those data structures is fundamentally broken.
I've spent a HUGE amount of time in the past few years dealing with
people that cavalierly violate the layering/isolation rules like this
and my tolerance for this mis-behavior is very low.
Tony
OSR
I am working on Network Redirector Driver, the problem is hung, the strange thing is if Length in bytes of the data from CcCopyRead and CcCopyWrite is 0x10000 (64KB) or less, I don't have such problem, only for Length is 0x80000 (512 KB), change READ_AHEAD_GRANULARITY from 0x10000 (64KB) to 0x80000 (512 KB) inCcSetReadAheadGranularity, it doen't help.
Thanks,
Tao
> Subject: RE: [ntfsd] CcCopyRead and CcCopyWrite don't finish if Length in bytes of the data is 0x80000 (512 KB) on Windows Vista> Date: Wed, 13 Aug 2008 12:35:10 -0400> From: [email protected]> To: [email protected]> > Max's final point is the one people need to keep in mind:> > "these fields are not intended to be accessed from filters. The FSD owns> them."> > If you assume you know what the underlying file system's locking model> is, you're broken. If possible, at least restrict your broken software> to working with a single file system - that way the fact you are broken> is less likely to leak out.> > Note: there is NO requirement that an FSD use either of these resources.> There are flags that indicate (for FsRtl's benefit) which resources ARE> used, but the locking callbacks have been added to give the file system> greater flexibility in building locking models. Outside FsRtl (which> explicitly requires a format to use its functions) ANY component that> reaches into FileObject->FsContext and assumes it knows the format of> those data structures is fundamentally broken.> > I've spent a HUGE amount of time in the past few years dealing with> people that cavalierly violate the layering/isolation rules like this> and my tolerance for this mis-behavior is very low.> > Tony> OSR> > > ---> NTFSD is sponsored by OSR> > For our schedule debugging and file system seminars> (including our new fs mini-filter seminar) visit: > http://www.osr.com/seminars> > You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ''> To unsubscribe send a blank email to [email protected]
_________________________________________________________________
happen. The question is "For what are they waiting?"
64KB is a magic number in virtual memory - it's the unit of granular
mapping in the memory manager. 256KB is a magic number as well as it's
the unit of address management in the cache manager. So when you see
something that "works" in one case but not in another and the units
involved are one of these it suggests you're invoking some additional
processing in one of these components (e.g., faulting in more data,
extending sections, creating new VACBs, etc.)
I've used CcCopyRead with values much larger than 64KB. It is not an
issue of the cache manager, but rather some operation your call is
invoking that is in turn relying on you (or someone else) to fulfill.
What does the debugger say? When you look at the stack trace of the
thread that called CcCopyRead, what does it say the thread is waiting to
have happen? If you figure that out, then try to determine why that
event is not occurring. It could be (for example) that you are getting
a callback into your file system driver to acquire a lock and you've
decided to use a non-reentrant lock (e.g., synchronization event or fast
mutex) or you've acquired an ERESOURCE in "shared" mode and then in the
same thread (via a callback) tried to acquire it in "exclusive" mode
(this *always* deadlocks and *never* tells you before it does so.)
Of course I assume you're running on the checked version of the NT
kernel and it's not reporting anything interesting. Naturally, you'd
also be using driver verifier and similarly *it* isn't reporting
anything. Finally, of course, since you didn't report anything unusual,
I assume that "!deadlock" said there was nothing it could find.
Tony
OSR
The bug that we had before, but only show up on Windows Vista with SP1, look like without SP1, we are luck that still work, I think CopyFileEx is change in SP1, we got CcCopyRead and CcCopyWrite with large value as 512 KB, before we check if IrpContext->Wait is not wait, we will FsdPostRequest, this is not correct, it will wait for WrPageOut, but works with small value.
Thanks,
Tao
Subject: RE: [ntfsd] CcCopyRead and CcCopyWrite don't finish if Length in bytes of the data is 0x80000 (512 KB) on Windows VistaDate: Thu, 14 Aug 2008 13:53:46 -0400From: [email protected]: [email protected]
Well, if it?s hung, it means the thread are waiting for something to happen. The question is ?For what are they waiting??
64KB is a magic number in virtual memory ? it?s the unit of granular mapping in the memory manager. 256KB is a magic number as well as it?s the unit of address management in the cache manager. So when you see something that ?works? in one case but not in another and the units involved are one of these it suggests you?re invoking some additional processing in one of these components (e.g., faulting in more data, extending sections, creating new VACBs, etc.)
I?ve used CcCopyRead with values much larger than 64KB. It is not an issue of the cache manager, but rather some operation your call is invoking that is in turn relying on you (or someone else) to fulfill. What does the debugger say? When you look at the stack trace of the thread that called CcCopyRead, what does it say the thread is waiting to have happen? If you figure that out, then try to determine why that event is not occurring. It could be (for example) that you are getting a callback into your file system driver to acquire a lock and you?ve decided to use a non-reentrant lock (e.g., synchronization event or fast mutex) or you?ve acquired an ERESOURCE in ?shared? mode and then in the same thread (via a callback) tried to acquire it in ?exclusive? mode (this *always* deadlocks and *never* tells you before it does so.)
Of course I assume you?re running on the checked version of the NT kernel and it?s not reporting anything interesting. Naturally, you?d also be using driver verifier and similarly *it* isn?t reporting anything. Finally, of course, since you didn?t report anything unusual, I assume that ?!deadlock? said there was nothing it could find.
Tony
OSR
--- NTFSD is sponsored by OSR For our schedule debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars You are currently subscribed to ntfsd as: unknown lmsubst tag argument: '' To unsubscribe send a blank email to [email protected]
_________________________________________________________________
A developer is having this same issue in a UDF File System Driver. How does he go about fixing it? The work he has done on it can be found at https://github.com/assorted/reactos/tree/udf.
If you have a specific problem open a new thread.
-scott
OSR