A question about tracking FsContext

Roman_Kudinov · March 27, 2007, 6:51am

Hi All,

I have read FAQ about proper handling of FsContext but some questions are still left:

The FAQ states:

For each IRP_MJ_CREATE, the filter driver increments the reference count on the per-file context structure.
For each IRP_MJ_CLOSE the filter driver decrements the reference count on the per-file context structure if the FO_STREAM_FILE bit is not set for the file object and if CcGetFileObjectFromSectionPtrs does not return this file object.
If the reference count for the per-file context structure reaches zero and both the ImageSectionObject and DataSectionObject of the SectionObjectPointers field from the FILE_OBJECT is zero, the filter driver may then delete the per-file context data.

The question is about n. 3), what if either of ImageSectionObject or DataSectionObject are not zero, how should the driver proceed in this way, should it wait for subsequent IRP_MJ_CLOSE when both of these items are zero?

Thanks,
Roman

Roman_Kudinov · March 29, 2007, 3:21am

One more question is should I increment/decrement the reference counter in the completion routine or should I do this in the dispatch routine after a call to IoCallDriver or should I do this in the dispatch routine before a call to IoCallDriver?
I see the strange behaviour when I get IRP_MJ_CLOSE with ImageSectionObject and DataSectionObject equal to NULL, and reference counter is got to zero, but in some time I get IRP_MJ_CREATE for the exactly same file with the exactly same FsContext. So I bet either I do something wrong or closing a file does not mean that a file system deletes FsContext from its structures

“Roman Kudinov” ???/??? ? ??? ???: news:xxxxx@ntfsd…
Hi All,

I have read FAQ about proper handling of FsContext but some questions are still left:

The FAQ states:

1) For each IRP_MJ_CREATE, the filter driver increments the reference count on the per-file context structure.
2) For each IRP_MJ_CLOSE the filter driver decrements the reference count on the per-file context structure if the FO_STREAM_FILE bit is not set for the file object and if CcGetFileObjectFromSectionPtrs does not return this file object.
3) If the reference count for the per-file context structure reaches zero and both the ImageSectionObject and DataSectionObject of the SectionObjectPointers field from the FILE_OBJECT is zero, the filter driver may then delete the per-file context data.

The question is about n. 3), what if either of ImageSectionObject or DataSectionObject are not zero, how should the driver proceed in this way, should it wait for subsequent IRP_MJ_CLOSE when both of these items are zero?

Thanks,
Roman

Lyndon_J_Clarke-2 · March 29, 2007, 4:13am

Hello Roman

It seems you have a so called legacy filter driver. I’d recommend you should
think about using FsRtlInsertPerStreamContext instead of reference counts if
at all possible. I’d also recommend you should think about moving to a
mini-filter

Cheers
Lyndon

“Roman Kudinov” wrote in message news:xxxxx@ntfsd…
Hi All,

I have read FAQ about proper handling of FsContext but some questions are
still left:

The FAQ states:

1) For each IRP_MJ_CREATE, the filter driver increments the reference count
on the per-file context structure.
2) For each IRP_MJ_CLOSE the filter driver decrements the reference count on
the per-file context structure if the FO_STREAM_FILE bit is not set for the
file object and if CcGetFileObjectFromSectionPtrs does not return this file
object.
3) If the reference count for the per-file context structure reaches zero
and both the ImageSectionObject and DataSectionObject of the
SectionObjectPointers field from the FILE_OBJECT is zero, the filter driver
may then delete the per-file context data.

The question is about n. 3), what if either of ImageSectionObject or
DataSectionObject are not zero, how should the driver proceed in this way,
should it wait for subsequent IRP_MJ_CLOSE when both of these items are
zero?

Thanks,
Roman

Roman_Kudinov · March 31, 2007, 3:22am

Helly Lyndon,

I have to support Win2k, IFS states that FsRtlInsertPerStreamContext
appeared with WinXP only, as I understand mini-filter cannot work on Win2k
too, right?

Thanks,
Roman

“Lyndon J Clarke” ÓÏÏÂÝÉÌ/ÓÏÏÂÝÉÌÁ × ÎÏ×ÏÓÔÑÈ
ÓÌÅÄÕÀÝÅÅ: news:xxxxx@ntfsd…
> Hello Roman
>
> It seems you have a so called legacy filter driver. I’d recommend you
> should think about using FsRtlInsertPerStreamContext instead of reference
> counts if at all possible. I’d also recommend you should think about
> moving to a mini-filter
>
> Cheers
> Lyndon
>
> “Roman Kudinov” wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> I have read FAQ about proper handling of FsContext but some questions are
> still left:
>
> The FAQ states:
>
> 1) For each IRP_MJ_CREATE, the filter driver increments the reference
> count on the per-file context structure.
> 2) For each IRP_MJ_CLOSE the filter driver decrements the reference count
> on the per-file context structure if the FO_STREAM_FILE bit is not set for
> the file object and if CcGetFileObjectFromSectionPtrs does not return this
> file object.
> 3) If the reference count for the per-file context structure reaches zero
> and both the ImageSectionObject and DataSectionObject of the
> SectionObjectPointers field from the FILE_OBJECT is zero, the filter
> driver may then delete the per-file context data.
>
>
> The question is about n. 3), what if either of ImageSectionObject or
> DataSectionObject are not zero, how should the driver proceed in this way,
> should it wait for subsequent IRP_MJ_CLOSE when both of these items are
> zero?
>
>
> Thanks,
> Roman
>
>

OSR_Community_User · March 31, 2007, 6:08am

A minifilter can work on W2K if you have Service Pack 4 + Update Rollup
1 installed. There is also a
redistributable for W2K SP4 if you don’t want to require URP1 - but you
must contact MS support
to get it.

Regarding FsRtlInsertPerStreamContext - I’m not sure but I think that is
there in URP1 on W2K. When
FltMgr was back ported to w2k many filesystem macro’s and ddi’s
appeared but the docs were never
updated to show this. However, let me be clear I’m not sure if this call
is present or not.

Roman Kudinov wrote:

Helly Lyndon,

I have to support Win2k, IFS states that FsRtlInsertPerStreamContext
appeared with WinXP only, as I understand mini-filter cannot work on Win2k
too, right?

Thanks,
Roman

“Lyndon J Clarke” ÓÏÏÂÝÉÌ/ÓÏÏÂÝÉÌÁ × ÎÏ×ÏÓÔÑÈ
>ÓÌÅÄÕÀÝÅÅ: news:xxxxx@ntfsd…
>
>
>>Hello Roman
>>
>>It seems you have a so called legacy filter driver. I’d recommend you
>>should think about using FsRtlInsertPerStreamContext instead of reference
>>counts if at all possible. I’d also recommend you should think about
>>moving to a mini-filter
>>
>>Cheers
>>Lyndon
>>
>>“Roman Kudinov” wrote in message news:xxxxx@ntfsd…
>>Hi All,
>>
>>I have read FAQ about proper handling of FsContext but some questions are
>>still left:
>>
>>The FAQ states:
>>
>>1) For each IRP_MJ_CREATE, the filter driver increments the reference
>>count on the per-file context structure.
>>2) For each IRP_MJ_CLOSE the filter driver decrements the reference count
>>on the per-file context structure if the FO_STREAM_FILE bit is not set for
>>the file object and if CcGetFileObjectFromSectionPtrs does not return this
>>file object.
>>3) If the reference count for the per-file context structure reaches zero
>>and both the ImageSectionObject and DataSectionObject of the
>>SectionObjectPointers field from the FILE_OBJECT is zero, the filter
>>driver may then delete the per-file context data.
>>
>>
>>The question is about n. 3), what if either of ImageSectionObject or
>>DataSectionObject are not zero, how should the driver proceed in this way,
>>should it wait for subsequent IRP_MJ_CLOSE when both of these items are
>>zero?
>>
>>
>>Thanks,
>>Roman
>>
>>
>>
>>
>
>
>
>—
>Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
>You are currently subscribed to ntfsd as: xxxxx@comcast.net
>To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>