About minifilter using CcPinRead

NTFSD
1

Hello everyone?
My filter monitors file changes, captures file information at PreCleanup, and sends file path to user-mode service async. After several seconds, the user-mode service will open the file, check file header and then do some other operations. There are some issues when user-mode service check file header. So I want to optimize all this operations, At PreCleanup, I use CcPinRead to pin the file cache and check file header. I don?t want CcPinRead cause additional disk IO, so I call CcPinRead with PIN_NO_READ, if CcPinRead failed, the user-mode will continue to check file header. Here is my question : Is this approach OK?
Code:
try
{
LARGE_INTEGER Offset;
PVOID Bcb;
PVOID Buffer;

Offset = { 0 };

if (CcPinRead(FltObjects->FileObject,
&Offset,
PAGE_SIZE,
PIN_NO_READ,
&Bcb,
&Buffer))
{
// Check file header

CcUnpinData(Bcb);
}
}
except(1)
{
//…
}

2

Are you a layered file system? Did your driver originally call
CcInitializeCacheMap to establish caching on this file object? If not, then
you do not own the cache and cannot call the Cc APIs.

-scott
OSR

wrote in message news:xxxxx@ntfsd…

Hello everyone?
My filter monitors file changes, captures file information at
PreCleanup, and sends file path to user-mode service async. After several
seconds, the user-mode service will open the file, check file header and
then do some other operations. There are some issues when user-mode service
check file header. So I want to optimize all this operations, At PreCleanup,
I use CcPinRead to pin the file cache and check file header. I don?t want
CcPinRead cause additional disk IO, so I call CcPinRead with PIN_NO_READ, if
CcPinRead failed, the user-mode will continue to check file header. Here is
my question : Is this approach OK?
Code:
try
{
LARGE_INTEGER Offset;
PVOID Bcb;
PVOID Buffer;

Offset = { 0 };

if (CcPinRead(FltObjects->FileObject,
&Offset,
PAGE_SIZE,
PIN_NO_READ,
&Bcb,
&Buffer))
{
// Check file header

CcUnpinData(Bcb);
}
}
except(1)
{
//…
}

3

hi Scott Noone, I don’t implement a layered file system, but before I call CcPinRead, I use CcIsFileCached(FltObjects->FileObject) to check if fileobject is being cached by system, Is this OK?

thx

4

No, this is not allowed. You don’t own the caching state, this all belongs
to the file system beneath you.

-scott
OSR

wrote in message news:xxxxx@ntfsd…

hi Scott Noone, I don’t implement a layered file system, but before I call
CcPinRead, I use CcIsFileCached(FltObjects->FileObject) to check if
fileobject is being cached by system, Is this OK?

thx

5

Ok, thx Scott, This mean I can only call FltReadFile to read the file at PreCleanup. Is there any other approach that can check if file is cached by system at some file offset?

6

>Is there any other approach that can check if file is cached by system at

some file offset?

No, this information is private to the Cache Manager.

-scott
OSR

wrote in message news:xxxxx@ntfsd…

Ok, thx Scott, This mean I can only call FltReadFile to read the file at
PreCleanup. Is there any other approach that can check if file is cached by
system at some file offset?