FAST/IO Write vs TopLevelIrp = 2 writes & mapped files

NTFSD
1

The question is, fairly simple, if I filter all fast I/O writes, should I out filter the delayed writes that come from lazy writer with toplevelirp==2 ?

I’ve seen some bizzare things when a file is mapped. I saw no fast I/O but I’ve seen toplevelirp=2 writes, so this clearly answers my question, but how can a CreateFileMapping bypass my FS_FILTER_CALLBACKS , and more preciselly my preFilterOperation, when “Data->Parameters.AcquireForSectionSynchronization.SyncType == SyncTypeCreateSection” .

I try to catch all files that have been opened with any type of write access, I never see this though from notepad, but I’ve made a little application

CreateFile
CreateFileMapping -> triggers my callback
CloseFile
MapViewOfFile
modify in memory
UnmapView
CloseFileMapping

this does the expected in my driver.

When opened by notepad, I also tried the MmCanFileBeTruncated, way, called in Cleanup, but still no luck, the file acts as if it was not mapped, but in file spy I see delayed writes comming from mmod writer and also from cache manager.

I know the solver of all pbems would be waiting for close request, and I know then all references held from VMM and CacheManager will be released and so all data flushed, but I need interactivity, so I must know if a file is being memory written, so I can force flushes for those files, after a cleanup.
So my 2 questions remain:

  1. does fast io cover all cache manager activity
  2. why don’t I get my callback for section creation called, and how can I find out if a file object has an open user section.
2

Now I’ve come across a little relevancy, in the
AcquireForSectionSynchronization, I realized that System (PID = 4) creates a
stream FO (Data->Parameters. NotifyStreamFileObject.NotificationType =
NotifyTypeCreate ) and holds mapping backup writes, this kinda clears some
uncertainty upon the subject, because it was strange that after calling
CloseFile in my small app, the CLEANUP and CLOSE request came with no delay,
so there was an issue, who holds backup for the file, and why don’t I see
the Create.
Now looking at the section page protection it is rather easy to filter out
stream FO that are of no interest.

My question still remains:

  1. does fast io cover all cache manager activity or if I filter all fast io
    should I worry about extra IRP writes from the cache manager with
    TopLevelIrp == cache

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Friday, October 17, 2008 8:41 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FAST/IO Write vs TopLevelIrp = 2 writes & mapped files

The question is, fairly simple, if I filter all fast I/O writes, should I
out filter the delayed writes that come from lazy writer with toplevelirp==2
?

I’ve seen some bizzare things when a file is mapped. I saw no fast I/O but
I’ve seen toplevelirp=2 writes, so this clearly answers my question, but how
can a CreateFileMapping bypass my FS_FILTER_CALLBACKS , and more preciselly
my preFilterOperation, when
“Data->Parameters.AcquireForSectionSynchronization.SyncType ==
SyncTypeCreateSection” .

I try to catch all files that have been opened with any type of write
access, I never see this though from notepad, but I’ve made a little
application

CreateFile
CreateFileMapping -> triggers my callback
CloseFile
MapViewOfFile
modify in memory
UnmapView
CloseFileMapping

this does the expected in my driver.

When opened by notepad, I also tried the MmCanFileBeTruncated, way, called
in Cleanup, but still no luck, the file acts as if it was not mapped, but in
file spy I see delayed writes comming from mmod writer and also from cache
manager.

I know the solver of all pbems would be waiting for close request, and I
know then all references held from VMM and CacheManager will be released and
so all data flushed, but I need interactivity, so I must know if a file is
being memory written, so I can force flushes for those files, after a
cleanup.
So my 2 questions remain:

  1. does fast io cover all cache manager activity
  2. why don’t I get my callback for section creation called, and how can I
    find out if a file object has an open user section.

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

I dont understand this question. AFAIK you should not see FastIoWrite from
cache manager at all.

“Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
> Now I’ve come across a little relevancy, in the
> AcquireForSectionSynchronization, I realized that System (PID = 4) creates
> a
> stream FO (Data->Parameters. NotifyStreamFileObject.NotificationType =
> NotifyTypeCreate ) and holds mapping backup writes, this kinda clears some
> uncertainty upon the subject, because it was strange that after calling
> CloseFile in my small app, the CLEANUP and CLOSE request came with no
> delay,
> so there was an issue, who holds backup for the file, and why don’t I see
> the Create.
> Now looking at the section page protection it is rather easy to filter out
> stream FO that are of no interest.
>
> My question still remains:
>
> 1) does fast io cover all cache manager activity or if I filter all fast
> io
> should I worry about extra IRP writes from the cache manager with
> TopLevelIrp == cache
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> Sent: Friday, October 17, 2008 8:41 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] FAST/IO Write vs TopLevelIrp = 2 writes & mapped files
>
> The question is, fairly simple, if I filter all fast I/O writes, should I
> out filter the delayed writes that come from lazy writer with
> toplevelirp==2
> ?
>
> I’ve seen some bizzare things when a file is mapped. I saw no fast I/O but
> I’ve seen toplevelirp=2 writes, so this clearly answers my question, but
> how
> can a CreateFileMapping bypass my FS_FILTER_CALLBACKS , and more
> preciselly
> my preFilterOperation, when
> “Data->Parameters.AcquireForSectionSynchronization.SyncType ==
> SyncTypeCreateSection” .
>
> I try to catch all files that have been opened with any type of write
> access, I never see this though from notepad, but I’ve made a little
> application
>
> CreateFile
> CreateFileMapping -> triggers my callback
> CloseFile
> MapViewOfFile
> modify in memory
> UnmapView
> CloseFileMapping
>
> this does the expected in my driver.
>
> When opened by notepad, I also tried the MmCanFileBeTruncated, way, called
> in Cleanup, but still no luck, the file acts as if it was not mapped, but
> in
> file spy I see delayed writes comming from mmod writer and also from cache
> manager.
>
> I know the solver of all pbems would be waiting for close request, and I
> know then all references held from VMM and CacheManager will be released
> and
> so all data flushed, but I need interactivity, so I must know if a file is
> being memory written, so I can force flushes for those files, after a
> cleanup.
> So my 2 questions remain:
> 1) does fast io cover all cache manager activity
> 2) why don’t I get my callback for section creation called, and how can I
> find out if a file object has an open user section.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

4

No, no no . You misunderstood. I meant writes to the system cache via the
fast io path, not what the cache manager do after deciding it is time for
some data flush and issuing paging io writes via the IRP_MJ_WRITE path.

You could write to the system cache via the Copy interface, the Pin
interface mdl interface, fast io path, I know FsRtlCopyWrite could even be
put instead of your FastIoWrite handler.
My question was if I handle the fast io path writes, should I ignore the
normal top level irp = CACHE_MANAGER writes (of course if the writes where
successful to the system cache, then that doesn’t mean they will be
successful to disk always) , but now I know you shouldn’t.

Thanks.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Lyndon J Clarke
Sent: Wednesday, October 29, 2008 12:00 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] FAST/IO Write vs TopLevelIrp = 2 writes & mapped files

I dont understand this question. AFAIK you should not see FastIoWrite from
cache manager at all.

“Bercea Gabriel” wrote in message news:xxxxx@ntfsd…
> Now I’ve come across a little relevancy, in the
> AcquireForSectionSynchronization, I realized that System (PID = 4) creates

> a
> stream FO (Data->Parameters. NotifyStreamFileObject.NotificationType =
> NotifyTypeCreate ) and holds mapping backup writes, this kinda clears some
> uncertainty upon the subject, because it was strange that after calling
> CloseFile in my small app, the CLEANUP and CLOSE request came with no
> delay,
> so there was an issue, who holds backup for the file, and why don’t I see
> the Create.
> Now looking at the section page protection it is rather easy to filter out
> stream FO that are of no interest.
>
> My question still remains:
>
> 1) does fast io cover all cache manager activity or if I filter all fast
> io
> should I worry about extra IRP writes from the cache manager with
> TopLevelIrp == cache
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
> Sent: Friday, October 17, 2008 8:41 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] FAST/IO Write vs TopLevelIrp = 2 writes & mapped files
>
> The question is, fairly simple, if I filter all fast I/O writes, should I
> out filter the delayed writes that come from lazy writer with
> toplevelirp==2
> ?
>
> I’ve seen some bizzare things when a file is mapped. I saw no fast I/O but
> I’ve seen toplevelirp=2 writes, so this clearly answers my question, but
> how
> can a CreateFileMapping bypass my FS_FILTER_CALLBACKS , and more
> preciselly
> my preFilterOperation, when
> “Data->Parameters.AcquireForSectionSynchronization.SyncType ==
> SyncTypeCreateSection” .
>
> I try to catch all files that have been opened with any type of write
> access, I never see this though from notepad, but I’ve made a little
> application
>
> CreateFile
> CreateFileMapping -> triggers my callback
> CloseFile
> MapViewOfFile
> modify in memory
> UnmapView
> CloseFileMapping
>
> this does the expected in my driver.
>
> When opened by notepad, I also tried the MmCanFileBeTruncated, way, called
> in Cleanup, but still no luck, the file acts as if it was not mapped, but
> in
> file spy I see delayed writes comming from mmod writer and also from cache
> manager.
>
> I know the solver of all pbems would be waiting for close request, and I
> know then all references held from VMM and CacheManager will be released
> and
> so all data flushed, but I need interactivity, so I must know if a file is
> being memory written, so I can force flushes for those files, after a
> cleanup.
> So my 2 questions remain:
> 1) does fast io cover all cache manager activity
> 2) why don’t I get my callback for section creation called, and how can I
> find out if a file object has an open user section.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com