Force non cached file access

NTFSD
1

Hello!

I am devloping a mini filter driver and doing an experiment to force non cached file access.

At PreCreate callback, I do,

  1. Check if the file is what I am interested in and needs to be accessed only in non cached mode.
  2. If yes, do
    2.1 Data->Iopb->Parameters.Create.Options = Data->Iopb->Parameters.Create.Options | FILE_NO_INTERMEDIATE_BUFFERING;
    2.2. FltSetCallbackDataDirty( Data );

Basically, I did the same thing as this post http://www.osronline.com/showThread.cfm?link=88443 did.

Besides, I also make sure fast/io disallowed at PreCreate, PreRead, PreWrite.

However, this seems not work. I tested my driver with a WORD document. When open it at the second time, I didn’t get any paging or non-cached read IRP. Using FileSpy, I can see the SOP has the same value as the one at the first time open it, and so does its member DataSectionObject.

What else should I do in order to force non cached file access? Thank you.

P.S. I read the post http://www.osronline.com/showThread.cfm?link=88443 and understand the risk. My purpose is for experiment to find out how to force non cached i/o.

2

Disabling caching in this way disables the use of the cache manager; it does not disable support for memory mapped files.

So the file isn’t cached by the cache manager, but that isn’t what you wanted it to do.

If you want to disable memory mapped files, you can do that in the section creation callback. That will cause application failures, but it will prevent caching.

Tony
OSR

3

Tony,

I took your suggestion and tried to disable memory mapped files. However, it still doesn’t seem work. I saw the same results as what I described at the beginning.

Here is what I did at pre IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION,

if(Data->Iopb->Parameters.AcquireForSectionSynchronization.SyncType == SyncTypeCreateSection &&
Data->Iopb->Parameters.AcquireForSectionSynchronization.PageProtection !=
PAGE_EXECUTE) {
Data->IoStatus.Status = STATUS_ACCESS_DENIED;
Data->IoStatus.Information = 0;
retStatus = FLT_PREOP_COMPLETE;
}

Did I miss something?

Thank you.

4

Indeed, you must be missing something, no doubt in the details of the implementation.

Did you look at the file object in question? The FO_NO_INTERMEDIATE_BUFFERING bit should be set in post create (if it isn’t then there’s something wrong with your logic.)

Also, if you do I/O on the file that is not properly aligned it should fail (e.g., use file test to read a byte from your file.)

Tony
OSR

5

> I am devloping a mini filter driver and doing an experiment to force non cached file access.

Impossible.

First, compressed and encrypted files are always cached, cache is used as the output buffer for decompressor/decryptor code.

Second, even if the file is not compressed/encrypted, you will break most apps (Word for sure) by imposing the alignment requirement they are not accustomed to.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

6

I am not certain what is your objective for forcing the non-cache IO.
But you can try the following, if you don’t want to break the application.

  1. Complete the original request in your driver.
  2. Create new FO (if required), allocated aligned buffer, align length
    and offset, and performed the non-cached IO using FltRead/WriteFile.
  3. Only copy the data requested by the applications in user buffer and
    update the IoStatus block with the information (You need to make sure
    Information field shall be same as requested length, otherwise some of
    the application will break).

Limitation: As mentioned previously in this thread or earlier threads
you read. Memory mapped files, Compressed files etc will not work.

Maxim S. Shatskih wrote:

> I am devloping a mini filter driver and doing an experiment to force non cached file access.

Impossible.

First, compressed and encrypted files are always cached, cache is used as the output buffer for decompressor/decryptor code.

Second, even if the file is not compressed/encrypted, you will break most apps (Word for sure) by imposing the alignment requirement they are not accustomed to.

7

The following is my experimental code. Tryied on a system for sevel minutes, and I only see very few debug output “no buffering”. Too few.

MS filter manager ignores the change on create options?

=================================================================
MyPostCreateOperationCallback (__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__in PVOID CompletionContext,
__in FLT_POST_OPERATION_FLAGS Flags)
{
__try {
if(FlagOn(FltObjects->FileObject->Flags, FO_NO_INTERMEDIATE_BUFFERING)) {
LOG_PRINT(LOGFL_DEBUG,
(“postCreate: no buffering\n”));
}
if(FltIsCallbackDataDirty(Data)) {
LOG_PRINT(LOGFL_ERRORS,
(“postCreate: change create parameter!!!\n”));
}

} __except (EXCEPTION_EXECUTE_HANDLER) {
return FLT_POSTOP_FINISHED_PROCESSING;
}

return FLT_POSTOP_FINISHED_PROCESSING;
}/*–MyPostCreateOperationCallback–*/

MyPreCreateOperationCallback (__inout PFLT_CALLBACK_DATA Data,
__in PCFLT_RELATED_OBJECTS FltObjects,
__deref_out_opt PVOID *CompletionContext
)
{
FLT_PREOP_CALLBACK_STATUS returnStatus = FLT_PREOP_SUCCESS_WITH_CALLBACK;

__try {
if(FLT_IS_FASTIO_OPERATION(Data)) {
//not allow fast i/o
return FLT_PREOP_DISALLOW_FASTIO;
}

if(FlagOn(Data->Iopb->Parameters.Create.Options,
FILE_DIRECTORY_FILE)) {
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}

Data->Iopb->Parameters.Create.Options = Data->Iopb->Parameters.Create.Options|FILE_NO_INTERMEDIATE_BUFFERING;
Data->Iopb->IrpFlags |= IRP_NOCACHE;
FltSetCallbackDataDirty( Data );
if(!FltIsCallbackDataDirty(Data)) {
LOG_PRINT(LOGFL_ERRORS,
(“MyPreCreate: faile to change create parameter!!!\n”));
}

return returnStatus;
} __except ( EXCEPTION_EXECUTE_HANDLER ) {
return FLT_PREOP_SUCCESS_NO_CALLBACK;
}
} /*–MyPreCreateOperationCallback–*/

8

This is controlled by the file system. It would seem you are being ignored for some reason (there are reasons an FSD might ignore a request for no caching.)

Tony
OSR