Mark,
The context cleanup callback for stream contexts is called when the file
system is tearing down its internal FCB/SCB structure. File systems
like NTFS cache these structures so all you can rely on is:
- It will occur sometime after the last close
- It will occur sometime after you have seen the last pre-close
callback.
- It may occur after you have seen the last post-close callback.
- It is possible for a file to be opened and closed multiple times and
the context will not be deleted between uses.
The reason you don’t have access to a file object at this time is
because it may be long gone.
Ken’s idea of querying for the file size in every post-cleanup and
storing it in your stream context is a good one. This is a very
inexpensive operation
Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Wednesday, March 23, 2005 4:35 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Detect last file close in mini-filter?
Mark:
Good question. You could call FltGetContexts() in post-cleanup to get
the
stream context, but I don’t think it will find other FileObjects that
happen
to reference the same file. I guess it depends on knowing the file size
at
that instant is of value to you.
I call FltQueryInformationFile() in my post-cleanup routine. The
FileObject
is still available, so I don’t think there’s much overhead – probably
no
disk I/O just to get the size.
However, note that the post-cleanup callback is called in an arbitrary
thread context at IRQL <= DISPATCH_LEVEL (=2). Many operations
(including
FltQueryInformationFile) must be performed at APC_LEVEL (=1) or
PASSIVE_LEVEL (=0), so you’ll have to FltQueueDeferredIoWorkItem() to do
it.
Ken
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Wednesday, March 23, 2005 3:16 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Detect last file close in mini-filter?
In my mini-filter I need to get the final file size of a file when it is
finished being written to. Is the stream context cleanup routine the
only
place that knows the last file object for a stream is being closed, or
is
there some way to know in a close (or cleanup) pre-operation that the
close
is going to be the last one? In my legacy filter I knew because I was
the
one keeping track of the contexts but now the filter manager is doing
that
for me.
Has the final close already happened when the stream context cleanup
routine
runs or is it just about to happen? If it hasn’t happened yet could I
use
the final file object to query the length?
How can I get a file object to use for a file operation like this when I
only have the stream context? I guess I could try to keep track of all
the
open file objects for a stream but this is what the filter manager is
already doing. I could do a new open using the name but this pretty
expensive and if the last close is about to happen I’m not sure I could
do a
new open safely.
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com