Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

FCB Details

OSR_Community_UserOSR_Community_User Member Posts: 110,217
Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

Thanks in advance.

Regards,
Kailas Joshi


---------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.

Comments

  • Victor_FisyukVictor_Fisyuk Member Posts: 23
    Driver create FCB when a byte stream is being opened for the first time and no other FCB representing this byte stream currently exists in system memory. This structure is retained as long as any NT components maintains a reference for it (some field in FCB structure).

    Best regards,
    Fisyuk Victor
    "Kailas Joshi" wrote in message news:[email protected]
    Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

    Thanks in advance.

    Regards,
    Kailas Joshi


    ------------------------------------------------------------------------------
    Yahoo! Mail
    Bring photos to life! New PhotoMail makes sharing a breeze.
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hi Victor,

    Thanx for so quick reply.

    Actually, I am writing a filter driver in which I want to report a file of size 2000 bytes as of size 8192 bytes.

    This was not working even after changing file size in DIR_CONTROL -> QUERY_DIRECTORY as well as QUERY_FILE_INFORMATION.
    Explorer was displaying modified file size (ie 8192 bytes) but while reading, it was sending only one IRP for read.

    However this started working when I changed FCB file size from the structure pointed by FSContext (I did that in IRP_CREATE).

    Now, file is being read properly (actually I am filtering READ request also to return proper data when it queries for extra bytes). But after unregistering the driver, I noticed that File Size was modified on disk also.

    To prevent this, I am setting original size in CLEANUP. Is this legal?

    Can you please elaboate exactly when this modified FCB is written to the disk?
    When should I reset FCB file size to its original value?

    Thanx in advance.
    Regards,
    Kailas Joshi



    ---------------------------------
    Yahoo! Mail
    Bring photos to life! New PhotoMail makes sharing a breeze.
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    What did you do about the fast I/O functions that also report file size?
    That's the only thing I could think of that changing the size in the
    FsContext would actually achieve, so my guess would be you aren't
    getting the fast I/O functions.



    Reaching into an FSDs private data structures and changing them is never
    going to provide you with reliable results - there are NO RULES about
    what the FSD does with these fields, so anything you do is likely to
    behave differently on different file system implementations.



    Regards,



    Tony



    Tony Mason

    Consulting Partner

    OSR Open Systems Resources, Inc.

    http://www.osr.com



    Looking forward to seeing you at the next OSR File Systems class in
    Boston, MA April 18-21, 2006.

    ________________________________

    From: [email protected]
    [mailto:[email protected]] On Behalf Of Kailas Joshi
    Sent: Tuesday, March 21, 2006 1:32 PM
    To: ntfsd redirect
    Subject: Re:[ntfsd] FCB Details



    Hi Victor,

    Thanx for so quick reply.

    Actually, I am writing a filter driver in which I want to report a file
    of size 2000 bytes as of size 8192 bytes.

    This was not working even after changing file size in DIR_CONTROL ->
    QUERY_DIRECTORY as well as QUERY_FILE_INFORMATION.
    Explorer was displaying modified file size (ie 8192 bytes) but while
    reading, it was sending only one IRP for read.

    However this started working when I changed FCB file size from the
    structure pointed by FSContext (I did that in IRP_CREATE).

    Now, file is being read properly (actually I am filtering READ request
    also to return proper data when it queries for extra bytes). But after
    unregistering the driver, I noticed that File Size was modified on disk
    also.

    To prevent this, I am setting original size in CLEANUP. Is this legal?

    Can you please elaboate exactly when this modified FCB is written to the
    disk?
    When should I reset FCB file size to its original value?
  • Victor_FisyukVictor_Fisyuk Member Posts: 23
    Hi,
    Best way you should intecept IRP packages IRP_MJ_QUERY_INFORMATION and and fast I/O FastIoQueryBasicInfo, FastIoQueryStandardInfo.
    FCB is FSD's internal data structure and you not must touch it.

    Best regards,
    Fisyuk Victor
    EMail/MSN: [email protected]
    Web: http://rockdbg.siteburg.com
    ----- Original Message -----
    From: Kailas Joshi
    Newsgroups: ntfsd
    To: [email protected]
    Sent: Tuesday, March 21, 2006 6:27 AM
    Subject: FCB Details


    Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

    Thanks in advance.

    Regards,
    Kailas Joshi


    ------------------------------------------------------------------------------
    Yahoo! Mail
    Bring photos to life! New PhotoMail makes sharing a breeze.
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Hi

    Thanks Tony and Victor.


    Actually, I am new to windows driver development. So, kindly correct me if I have made any wrong assumptions bellow.


    As far as I know, FastIO calls are used after at least one normal(IRP) call is made to the driver.

    I am not not handling any FastIO call currently. Of course, I will be doing that later. But I believe that it should work correcly at least for the first operation on file.


    Also, I was monitoring drive using FileMon and I didn't see any FastIO call being issued for the same file (a3.txt). (for the very first operation on that file)

    So.I have foll. doubts :

    1) how/when/from where os was getting the actual file size?
    2) Also, please let me know when (modified)FCB is getting written to the disk? (I am using SFILTER on NTFS)

    3) Can I proceed just be returning FALSE in FASTIO?
    I've tried this once. In that case also, system was taking original file size.

    Thanks in advance.

    Regards,
    Kailas Joshi

    ---------------------------------
    Yahoo! Mail
    Use Photomail to share photos without annoying attachments.
  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    There are only three ways for a caller to determine the size of a file
    on a mounted file system:



    (1) Via the IRP_MJ_QUERY_INFORMATION call;

    (2) By looking at the directory entry (this isn't recommended, since
    directory entries are not guaranteed to be current, but applications do
    it anyway.)

    (3) Via a fast I/O call.



    If you are building a filter, the fast I/O interface is not optional.
    It is only optional for a file system driver to implement. WHEN changes
    are committed to disk is not defined within the interface - that's
    entirely up to the file system, and different file systems implement
    different policy.



    The file system also reports the size of the file to the Cache Manager
    (CcSetFileSizes) but this normally only affects what the VM system shows
    in a mapped view of the file. The description that you've provided does
    not match the symptoms of this particular issue, however.



    My suggestion would be to build FAT and trace through it - or set an
    access breakpoint on the file size information and let it run (overnight
    most likely - access breakpoints cause the system to run very slowly
    normally.)



    Regards,



    Tony



    Tony Mason

    Consulting Partner

    OSR Open Systems Resources, Inc.

    http://www.osr.com



    Looking forward to seeing you at the next OSR File Systems class in
    Boston, MA April 18-21, 2006.
  • Victor_FisyukVictor_Fisyuk Member Posts: 23
    Hi,
    First calls Fast I/O. Fast I/O can return TRUE or FALSE, indicating whether or not the fast I/O operation was completed. If this operation was not completed or if Fast I/O was not available, then IRP is created and sent to driver stack. So for debugging you can return FALSE in FastIoQueryBasicInfo and FastIoQueryStandardInfo and debug only dispatch procedures for IRP.

    Best regards,
    Fisyuk Victor
    EMail/MSN: [email protected]
    Web: http://rockdbg.siteburg.com
    "Kailas Joshi" wrote in message news:[email protected]
    Hi

    Thanks Tony and Victor.


    Actually, I am new to windows driver development. So, kindly correct me if I have made any wrong assumptions bellow.



    As far as I know, FastIO calls are used after at least one normal(IRP) call is made to the driver.

    I am not not handling any FastIO call currently. Of course, I will be doing that later. But I believe that it should work correcly at least for the first operation on file.


    Also, I was monitoring drive using FileMon and I didn't see any FastIO call being issued for the same file (a3.txt). (for the very first operation on that file)

    So.I have foll. doubts :

    1) how/when/from where os was getting the actual file size?
    2) Also, please let me know when (modified)FCB is getting written to the disk? (I am using SFILTER on NTFS)

    3) Can I proceed just be returning FALSE in FASTIO?
    I've tried this once. In that case also, system was taking original file size.

    Thanks in advance.

    Regards,
    Kailas Joshi


    ------------------------------------------------------------------------------
    Yahoo! Mail
    Use Photomail to share photos without annoying attachments.
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Writing WDF Drivers 13 April 2020 OSR Seminar Space & ONLINE
Developing Minifilters 20 Apr 2020 OSR Seminar Space & ONLINE
Internals & Software Drivers TBD Dulles, VA