I have a questions for layered file system

i write layered file system prototype.

i will create virtual volume device object after than mount my own file system driver(NOT filter driver)

SO If i want to send IRP to real file system do i have to attach real volume?

or is there any way to send IRP to real file system?

i am sorry for my explain if you do not understand what i am saying just tell me that

i will rewrite it…

please help me…

i already read so much thread… but i was not able to find any solution…

Hi,

Read this http://www.osronline.com/cf.cfm?PageURL=showThread.CFM?link=279207

I think this discussion has a lot in common with your question.
In short - you don’t need a volume to implement file system functionality.

IoCallDriver(DeviceObject, Irp); - https://msdn.microsoft.com/en-us/library/windows/hardware/ff548336(v=vs.85).aspx

All you need is the device object for something on the file system and you can send an IRP. You don’t need to be attached to it to do so.

Tony
OSR

Thank you for your reply

but when i Call IoCallDriver i got BSOD low stack…

i send IRP to physical volume.

i seem like pointer value fltmgr device object.

here is my code

MyFileObject = IoCreateStreamFileObjectLite(fileObject, NULL);

RtlInitUnicodeString(&MyFileObject->FileName, filename);

MyFileObject->Flags = fileObject->Flags & ~(FO_STREAM_FILE | FO_HANDLE_CREATED | FO_CLEANUP_COMPLETE);

KeInitializeEvent(&MyFileObject->Lock, SynchronizationEvent, FALSE);
KeInitializeEvent(&MyFileObject->Event, NotificationEvent, FALSE);

irpSp->FileObject = MyFileObject;
IoCopyCurrentIrpStackLocationToNext(Irp);
status = IoCallDriver(dcb->ORGDeviceObject, Irp);

where do i have to send IRP or do i have to fix some parameter?

Then you are not setting your own device object up properly. DeviceObject->StackSize should be set to the size of the longest stack you intend on invoking *plus one* for your driver. This is a basic driver rule and has been for the past 23+ years.

Tony
OSR


NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:>

thank you for your reply

Actually i have had experience of windows kernel but i have experience of linux kernel.

can i get some sample for layered file system?

or i will write on-the-fly file system using layered fsd but if i want to write it filter(not mini-filter) is it possible to write on-the-fly with filter?

which one is better filter and file system(layered fsd)?

sorry for my reply question…

We can license a full kit to you, but it is not a free example and represents many years of development work at this point. Building a layered file system is challenging in Windows, but at least it is possible. The Linux model does not support layered file systems (their focus is on constructing new file systems via FUSE). It is possible to layer on Linux, but it’s just not supported and strongly discouraged (I’ve been part of a team that has layered the VFS layer before. It’s ugly.)

Better in terms of what?

In terms of complexity I would rank them (from easiest to most difficult):

(1) Do-nothing filter. There are more examples of this than anything else. It’s easy to measure and count activity.
(2) File system driver. There’s complexity here, but the lower edge is generally simple. File systems have quit a lot of control, which helps mitigate the complexity of interaction with the OS.
(3) Isolation Filters. These are what you use for doing things like layered file systems, encryption, compression, data staging/fulfillment drivers, HSMs, etc. These manage the cache themselves, but have the complex upper/lower edge interface.
(4) Ad-hoc Filters. These have a tendency of starting in category (1) but then gain functionality. *If* you can strictly limit them, they can be simple, but the moment you try to generalize them, they become complex. People in this space often end up violating various rules in Windows in order to attempt to avoid implementing (3), such as trying to manipulate the underlying file system’s cache (which can’t be done safely). Usually this is where someone starts before they end up either giving up (because the product is never stable) or they learn enough to move to (3).

I don’t know enough about what you are trying to accomplish to suggest the right solution. I would suggest that you might benefit from sitting through my file systems class next month, though I understand if you’d prefer to learn it on your own.

Good luck!

Tony
OSR

oh thanks a lot for your reply

actually i would like to attend your class.

but i have to buy a ticket because your class so far from here.

Thanks you so much

i will suggest my company for buying development kit