CLEANUP or CLOSE?

NTFSD
1

I’m writing a test filter which will copy certain files opened by a user
when they have finished using them.
When a user opens a file I’m interested in, I set a stream context and wait
for an IRP_MJ_CLEANUP to come through. I then take a backup/copy of the file
elsewhere on the filesystem.

After doing more reading it appears that further paging IO can happen to
this file after the CLEANUP has been sent, which could mean that my backup
of the file is out of date. Waiting for the CLOSE also doesn’t appear to be
an option as this can come through much later.

Can someone explain what my options are please?

Thank you.

2

I’m not sure I understand. Do you need to look at the backup file in the
meantime ? I mean, looks like you want a snapshot of the file at a certain
point in time, but don’t forget there can be multiple handles and thus
multiple people writing to the file. Also, if the file is memory mapped,
even if process A is writing to the file (writing to the memory that is
backed by the file), the OS doesn’t have to use the same FILE_OBJECT that
was opened by process A…

So, what exactly do you need the backup file to be ?

Thanks,
Alex.

On Wed, Feb 5, 2014 at 8:52 AM, Ged Murphy wrote:

> I’m writing a test filter which will copy certain files opened by a user
> when they have finished using them.
> When a user opens a file I’m interested in, I set a stream context and wait
> for an IRP_MJ_CLEANUP to come through. I then take a backup/copy of the
> file
> elsewhere on the filesystem.
>
> After doing more reading it appears that further paging IO can happen to
> this file after the CLEANUP has been sent, which could mean that my backup
> of the file is out of date. Waiting for the CLOSE also doesn’t appear to be
> an option as this can come through much later.
>
> Can someone explain what my options are please?
>
> Thank you.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

3

I just want to make a copy of the file once all handles to the file are
closed (i.e. when I receive CLEANUP) and to make sure I only take a copy
once all the data has been written to that file.

Maybe I’m misunderstanding something here, but it seems that more data can
be written to the file after the CLEANUP IRP has been sent. For example data
not yet flushed from the cache manager. This data would be flushed when the
last reference to the file object is closed (i.e. when I receive CLOSE), but
this could be sent at any time.

Am making any sense or am I missing something?

Thanks.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alex Carp
Sent: 05 February 2014 17:51
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] CLEANUP or CLOSE?

I’m not sure I understand. Do you need to look at the backup file in the
meantime ? I mean, looks like you want a snapshot of the file at a certain
point in time, but don’t forget there can be multiple handles and thus
multiple people writing to the file. Also, if the file is memory mapped,
even if process A is writing to the file (writing to the memory that is
backed by the file), the OS doesn’t have to use the same FILE_OBJECT that
was opened by process A…

So, what exactly do you need the backup file to be ?

Thanks,

Alex.

On Wed, Feb 5, 2014 at 8:52 AM, Ged Murphy mailto:xxxxx > wrote:

I’m writing a test filter which will copy certain files opened by a user
when they have finished using them.
When a user opens a file I’m interested in, I set a stream context and wait
for an IRP_MJ_CLEANUP to come through. I then take a backup/copy of the file
elsewhere on the filesystem.

After doing more reading it appears that further paging IO can happen to
this file after the CLEANUP has been sent, which could mean that my backup
of the file is out of date. Waiting for the CLOSE also doesn’t appear to be
an option as this can come through much later.

Can someone explain what my options are please?

Thank you.

—
NTFSD is sponsored by OSR

OSR is hiring!! Info at http://www.osr.com/careers

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

— NTFSD is sponsored by OSR OSR is hiring!! Info at
http://www.osr.com/careers For our schedule of debugging and file system
seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List
Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx>

4

Cleanup represents the last user handle to that file object. Nothing says there aren’t other file objects referencing the actual underlying file.

Or imagine the case in which a user opens the file, then memory maps it, then closes the file but keeps the mapping - the file can still see paging I/O operations (and this doesn’t even require multiple file objects).

Note that the ONLY I/O that you can see on a file object that has completed IRP_MJ_CLEANUP by the FSD is paging I/O: read, write, query/set information (file sizes).

Tony
OSR