FCB Details

Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

Thanks in advance.

Regards,
Kailas Joshi


Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.

Driver create FCB when a byte stream is being opened for the first time and no other FCB representing this byte stream currently exists in system memory. This structure is retained as long as any NT components maintains a reference for it (some field in FCB structure).

Best regards,
Fisyuk Victor
“Kailas Joshi” wrote in message news:xxxxx@ntfsd…
Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

Thanks in advance.

Regards,
Kailas Joshi

------------------------------------------------------------------------------
Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.

Hi Victor,

Thanx for so quick reply.

Actually, I am writing a filter driver in which I want to report a file of size 2000 bytes as of size 8192 bytes.

This was not working even after changing file size in DIR_CONTROL -> QUERY_DIRECTORY as well as QUERY_FILE_INFORMATION.
Explorer was displaying modified file size (ie 8192 bytes) but while reading, it was sending only one IRP for read.

However this started working when I changed FCB file size from the structure pointed by FSContext (I did that in IRP_CREATE).

Now, file is being read properly (actually I am filtering READ request also to return proper data when it queries for extra bytes). But after unregistering the driver, I noticed that File Size was modified on disk also.

To prevent this, I am setting original size in CLEANUP. Is this legal?

Can you please elaboate exactly when this modified FCB is written to the disk?
When should I reset FCB file size to its original value?

Thanx in advance.
Regards,
Kailas Joshi


Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.

What did you do about the fast I/O functions that also report file size?
That’s the only thing I could think of that changing the size in the
FsContext would actually achieve, so my guess would be you aren’t
getting the fast I/O functions.

Reaching into an FSDs private data structures and changing them is never
going to provide you with reliable results - there are NO RULES about
what the FSD does with these fields, so anything you do is likely to
behave differently on different file system implementations.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Kailas Joshi
Sent: Tuesday, March 21, 2006 1:32 PM
To: ntfsd redirect
Subject: Re:[ntfsd] FCB Details

Hi Victor,

Thanx for so quick reply.

Actually, I am writing a filter driver in which I want to report a file
of size 2000 bytes as of size 8192 bytes.

This was not working even after changing file size in DIR_CONTROL ->
QUERY_DIRECTORY as well as QUERY_FILE_INFORMATION.
Explorer was displaying modified file size (ie 8192 bytes) but while
reading, it was sending only one IRP for read.

However this started working when I changed FCB file size from the
structure pointed by FSContext (I did that in IRP_CREATE).

Now, file is being read properly (actually I am filtering READ request
also to return proper data when it queries for extra bytes). But after
unregistering the driver, I noticed that File Size was modified on disk
also.

To prevent this, I am setting original size in CLEANUP. Is this legal?

Can you please elaboate exactly when this modified FCB is written to the
disk?
When should I reset FCB file size to its original value?

Hi,
Best way you should intecept IRP packages IRP_MJ_QUERY_INFORMATION and and fast I/O FastIoQueryBasicInfo, FastIoQueryStandardInfo.
FCB is FSD’s internal data structure and you not must touch it.

Best regards,
Fisyuk Victor
EMail/MSN: xxxxx@rambler.ru
Web: http://rockdbg.siteburg.com
----- Original Message -----
From: Kailas Joshi
Newsgroups: ntfsd
To: xxxxx@lists.osr.com
Sent: Tuesday, March 21, 2006 6:27 AM
Subject: FCB Details

Can anybody please tell me exactly when FCB is created from the disk data and when it is written back to the disk?

Thanks in advance.

Regards,
Kailas Joshi


Yahoo! Mail
Bring photos to life! New PhotoMail makes sharing a breeze.

Hi

Thanks Tony and Victor.

Actually, I am new to windows driver development. So, kindly correct me if I have made any wrong assumptions bellow.

As far as I know, FastIO calls are used after at least one normal(IRP) call is made to the driver.

I am not not handling any FastIO call currently. Of course, I will be doing that later. But I believe that it should work correcly at least for the first operation on file.

Also, I was monitoring drive using FileMon and I didn’t see any FastIO call being issued for the same file (a3.txt). (for the very first operation on that file)

So.I have foll. doubts :

  1. how/when/from where os was getting the actual file size?

  2. Also, please let me know when (modified)FCB is getting written to the disk? (I am using SFILTER on NTFS)

  3. Can I proceed just be returning FALSE in FASTIO?
    I’ve tried this once. In that case also, system was taking original file size.

Thanks in advance.

Regards,
Kailas Joshi


Yahoo! Mail
Use Photomail to share photos without annoying attachments.

There are only three ways for a caller to determine the size of a file
on a mounted file system:

(1) Via the IRP_MJ_QUERY_INFORMATION call;

(2) By looking at the directory entry (this isn’t recommended, since
directory entries are not guaranteed to be current, but applications do
it anyway.)

(3) Via a fast I/O call.

If you are building a filter, the fast I/O interface is not optional.
It is only optional for a file system driver to implement. WHEN changes
are committed to disk is not defined within the interface - that’s
entirely up to the file system, and different file systems implement
different policy.

The file system also reports the size of the file to the Cache Manager
(CcSetFileSizes) but this normally only affects what the VM system shows
in a mapped view of the file. The description that you’ve provided does
not match the symptoms of this particular issue, however.

My suggestion would be to build FAT and trace through it - or set an
access breakpoint on the file size information and let it run (overnight
most likely - access breakpoints cause the system to run very slowly
normally.)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 18-21, 2006.

Hi,
First calls Fast I/O. Fast I/O can return TRUE or FALSE, indicating whether or not the fast I/O operation was completed. If this operation was not completed or if Fast I/O was not available, then IRP is created and sent to driver stack. So for debugging you can return FALSE in FastIoQueryBasicInfo and FastIoQueryStandardInfo and debug only dispatch procedures for IRP.

Best regards,
Fisyuk Victor
EMail/MSN: xxxxx@rambler.ru
Web: http://rockdbg.siteburg.com
“Kailas Joshi” wrote in message news:xxxxx@ntfsd…
Hi

Thanks Tony and Victor.

Actually, I am new to windows driver development. So, kindly correct me if I have made any wrong assumptions bellow.

As far as I know, FastIO calls are used after at least one normal(IRP) call is made to the driver.

I am not not handling any FastIO call currently. Of course, I will be doing that later. But I believe that it should work correcly at least for the first operation on file.

Also, I was monitoring drive using FileMon and I didn’t see any FastIO call being issued for the same file (a3.txt). (for the very first operation on that file)

So.I have foll. doubts :

1) how/when/from where os was getting the actual file size?
2) Also, please let me know when (modified)FCB is getting written to the disk? (I am using SFILTER on NTFS)

3) Can I proceed just be returning FALSE in FASTIO?
I’ve tried this once. In that case also, system was taking original file size.

Thanks in advance.

Regards,
Kailas Joshi

------------------------------------------------------------------------------
Yahoo! Mail
Use Photomail to share photos without annoying attachments.