FSRTL_FLAG_USER_MAPPED_FILE being set

OSR_Community_User · March 2, 2005, 9:17am

I have seen cases where the FSRTL_FLAG_USER_MAPPED_FILE seems to arbitrarily
be set by the OS. If I do “echo junk > file.abc” I’ll see that this flag
gets set. It happens on some systems but not others. No other application
are running on the system other then standard OS modules. Questions:

Why is this USER flag getting mysteriously set?
Once set it stays set. Is there anyway to determine that a real USER
process has actually mapped a section.
Is there anyway to determine a real USER has unmapped a section?

Thanks,

Ken

OSR_Community_User · March 2, 2005, 9:41am

Hi,

I’m no expert in this, but only recently I found that
“more < M:\HelloWorld” does indeed open a file memory
mapped, while “more M:\HelloWorld” does not! [W2K]

I can only guess that this is the way cmd.exe treats
input/output re-direction (< and >)… Hm, and I consider
cmd.exe to be a real USER process.

Cheers,
Michael B.

Ken Galipeau wrote on 02.03.2005 15:16:26:
> I have seen cases where the FSRTL_FLAG_USER_MAPPED_FILE seems to
> arbitrarily be set by the OS. If I do ?echo junk > file.abc? I?ll
> see that this flag gets set. It happens on some systems but not
> others. No other application are running on the system other then
> standard OS modules. Questions:
>
> Why is this USER flag getting mysteriously set?
>
> Once set it stays set. Is there anyway to determine that a real USER
> process has actually mapped a section.
> Is there anyway to determine a real USER has unmapped a section?

---------------------------------------------------------------
Vogon International GmbH
http://www.vogon-international.com

OSR_Community_User · March 2, 2005, 8:29pm

Hi Micheal,

I know cmd.exe is a real user process and was using it as an example of a
program that sometimes maps and sometimes doesn’t on different systems even
when the syntax is the same…

I see the problem with applications that I know don’t open the file mapped
(database for instance).

Thanks,

Ken

From: xxxxx@vogon.de [mailto:xxxxx@vogon.de]
Sent: Wednesday, March 02, 2005 9:38 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

Hi,

I’m no expert in this, but only recently I found that
“more < M:\HelloWorld” does indeed open a file memory
mapped, while “more M:\HelloWorld” does not! [W2K]

I can only guess that this is the way cmd.exe treats
input/output re-direction (< and >)… Hm, and I consider
cmd.exe to be a real USER process.

Cheers,
Michael B.

Ken Galipeau wrote on 02.03.2005 15:16:26:
> I have seen cases where the FSRTL_FLAG_USER_MAPPED_FILE seems to
> arbitrarily be set by the OS. If I do “echo junk > file.abc” I’ll
> see that this flag gets set. It happens on some systems but not
> others. No other application are running on the system other then
> standard OS modules. Questions:
>
> Why is this USER flag getting mysteriously set?
>
> Once set it stays set. Is there anyway to determine that a real USER
> process has actually mapped a section.
> Is there anyway to determine a real USER has unmapped a section?

---------------------------------------------------------------
Vogon International GmbH
http://www.vogon-international.com — Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com

OSR_Community_User · March 4, 2005, 4:03pm

IIRC Jet database engine uses the mapped files.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Ken Galipeau
To: Windows File Systems Devs Interest List
Sent: Thursday, March 03, 2005 4:29 AM
Subject: RE: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

Hi Micheal,

I know cmd.exe is a real user process and was using it as an example of a program that sometimes maps and sometimes doesn’t on different systems even when the syntax is the same…

I see the problem with applications that I know don’t open the file mapped (database for instance).

Thanks,

Ken

From: xxxxx@vogon.de [mailto:xxxxx@vogon.de]
Sent: Wednesday, March 02, 2005 9:38 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

Hi,

I’m no expert in this, but only recently I found that
“more < M:\HelloWorld” does indeed open a file memory
mapped, while “more M:\HelloWorld” does not! [W2K]

I can only guess that this is the way cmd.exe treats
input/output re-direction (< and >)… Hm, and I consider
cmd.exe to be a real USER process.

Cheers,
Michael B.

Ken Galipeau wrote on 02.03.2005 15:16:26:
> I have seen cases where the FSRTL_FLAG_USER_MAPPED_FILE seems to
> arbitrarily be set by the OS. If I do “echo junk > file.abc” I’ll
> see that this flag gets set. It happens on some systems but not
> others. No other application are running on the system other then
> standard OS modules. Questions:
>
> Why is this USER flag getting mysteriously set?
>
> Once set it stays set. Is there anyway to determine that a real USER
> process has actually mapped a section.
> Is there anyway to determine a real USER has unmapped a section?

---------------------------------------------------------------
Vogon International GmbH
http://www.vogon-international.com — Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · March 14, 2005, 6:14pm

FSRTL_FLAG_USER_MAPPED_FILE is set a section backed by the file is
created, regardless of whether any views are created for that section.
Once set, this flag is not cleared.

This flag is the best hint a filter or file system has to whether this
file has ever been used to back a user mapped view. There is no way for
a filter to know when exactly when the mappings are created or closed.

Regards,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Friday, March 04, 2005 1:05 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

IIRC Jet database engine uses the mapped files.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: Ken Galipeau mailto:xxxxx
To: Windows File Systems Devs Interest List
mailto:xxxxx
Sent: Thursday, March 03, 2005 4:29 AM
Subject: RE: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

Hi Micheal,

I know cmd.exe is a real user process and was using it as an
example of a program that sometimes maps and sometimes doesn’t on
different systems even when the syntax is the same…

I see the problem with applications that I know don’t open the
file mapped (database for instance).

Thanks,

Ken

________________________________

From: xxxxx@vogon.de [mailto:xxxxx@vogon.de]
Sent: Wednesday, March 02, 2005 9:38 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] FSRTL_FLAG_USER_MAPPED_FILE being set

Hi,

I’m no expert in this, but only recently I found that
“more < M:\HelloWorld” does indeed open a file memory
mapped, while “more M:\HelloWorld” does not! [W2K]

I can only guess that this is the way cmd.exe treats
input/output re-direction (< and >)… Hm, and I consider
cmd.exe to be a real USER process.

Cheers,
Michael B.

Ken Galipeau wrote on 02.03.2005
15:16:26:
> I have seen cases where the FSRTL_FLAG_USER_MAPPED_FILE seems
to
> arbitrarily be set by the OS. If I do “echo junk > file.abc”
I’ll
> see that this flag gets set. It happens on some systems but
not
> others. No other application are running on the system other
then
> standard OS modules. Questions:
>
> Why is this USER flag getting mysteriously set?
>
> Once set it stays set. Is there anyway to determine that a
real USER
> process has actually mapped a section.
> Is there anyway to determine a real USER has unmapped a
section?

---------------------------------------------------------------
Vogon International GmbH
http://www.vogon-international.com — Questions? First check
the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are
currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To
unsubscribe send a blank email to xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com</mailto:xxxxx></mailto:xxxxx>