I see the FSRTL_FLAG_USER_MAPPED_FILE bit being set on a stream file as it
is begin closed. The application that open and then wrote the stream has NOT
memory mapped the stream or the base file. Can someone tell me why this is
happening?
Thanks,
Ken
Ken,
If you are seeing this flag set in the file object then it was memory mapped
for sure. It may be possible that the application you are using did not
memory map while writing to it but someone surely did memory map it at some
time ealier. Like for e.g notepad memory maps the file for reading and when
you write to it, it does cached writes.
This posting is provided “AS IS” with no warranties, and confers no rights.
“Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> I see the FSRTL_FLAG_USER_MAPPED_FILE bit being set on a stream file as it
> is begin closed. The application that open and then wrote the stream has
NOT
> memory mapped the stream or the base file. Can someone tell me why this
is
> happening?
>
>
>
> Thanks,
>
> Ken
>
>
Ravinder,
It is an application I wrote. It opens and writes to the stream doing a
CreateFile, WriteFile, CloseHandle. The base file of the stream also gets a
CreateFile, Rename, WriteFile CloseHandle. I do not open the file with any
other application. The funny thing is the FSRTL_FLAG_USER_MAPPED_FILE gets
set on the stream file that was opened the time the program previously ran.
And it is being set when that file is getting a cleanup operation.
Ken
-----Original Message-----
From: Ravinder Thind [mailto:xxxxx@windows.microsoft.com]
Sent: Tuesday, April 13, 2004 11:39 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] FSRTL_FLAG_USER_MAPPED_FILE
Ken,
If you are seeing this flag set in the file object then it was memory mapped
for sure. It may be possible that the application you are using did not
memory map while writing to it but someone surely did memory map it at some
time ealier. Like for e.g notepad memory maps the file for reading and when
you write to it, it does cached writes.
This posting is provided “AS IS” with no warranties, and confers no rights.
“Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> I see the FSRTL_FLAG_USER_MAPPED_FILE bit being set on a stream file as it
> is begin closed. The application that open and then wrote the stream has
NOT
> memory mapped the stream or the base file. Can someone tell me why this
is
> happening?
>
>
>
> Thanks,
>
> Ken
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Ken,
Which OS is this? On Windows XP SR memory maps the file and makes a copy of
it when it is being modified and may be you are seeing this behaviour
because of that. Any other filter drivers besides you on the stack?
This posting is provided “AS IS” with no warranties, and confers no rights.
“Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> Ravinder,
>
> It is an application I wrote. It opens and writes to the stream doing a
> CreateFile, WriteFile, CloseHandle. The base file of the stream also gets
a
> CreateFile, Rename, WriteFile CloseHandle. I do not open the file with any
> other application. The funny thing is the FSRTL_FLAG_USER_MAPPED_FILE gets
> set on the stream file that was opened the time the program previously
ran.
> And it is being set when that file is getting a cleanup operation.
>
> Ken
>
> -----Original Message-----
> From: Ravinder Thind [mailto:xxxxx@windows.microsoft.com]
> Sent: Tuesday, April 13, 2004 11:39 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] FSRTL_FLAG_USER_MAPPED_FILE
>
> Ken,
>
> If you are seeing this flag set in the file object then it was memory
mapped
> for sure. It may be possible that the application you are using did not
> memory map while writing to it but someone surely did memory map it at
some
> time ealier. Like for e.g notepad memory maps the file for reading and
when
> you write to it, it does cached writes.
>
> Thanks
> Ravinder
> –
> This posting is provided “AS IS” with no warranties, and confers no
rights.
>
> “Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> > I see the FSRTL_FLAG_USER_MAPPED_FILE bit being set on a stream file as
it
> > is begin closed. The application that open and then wrote the stream has
> NOT
> > memory mapped the stream or the base file. Can someone tell me why this
> is
> > happening?
> >
> >
> >
> > Thanks,
> >
> > Ken
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@legato.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Ravinder,
This is on XP SP1.
No other filters are running.
It is possible this is due to the MM using this as a paging file on a
subsequent run of the application? What is strange is that the FContext is
different.
Ken
-----Original Message-----
From: Ravinder Thind [mailto:xxxxx@windows.microsoft.com]
Sent: Tuesday, April 13, 2004 1:28 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] FSRTL_FLAG_USER_MAPPED_FILE
Ken,
Which OS is this? On Windows XP SR memory maps the file and makes a copy of
it when it is being modified and may be you are seeing this behaviour
because of that. Any other filter drivers besides you on the stack?
This posting is provided “AS IS” with no warranties, and confers no rights.
“Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> Ravinder,
>
> It is an application I wrote. It opens and writes to the stream doing a
> CreateFile, WriteFile, CloseHandle. The base file of the stream also gets
a
> CreateFile, Rename, WriteFile CloseHandle. I do not open the file with any
> other application. The funny thing is the FSRTL_FLAG_USER_MAPPED_FILE gets
> set on the stream file that was opened the time the program previously
ran.
> And it is being set when that file is getting a cleanup operation.
>
> Ken
>
> -----Original Message-----
> From: Ravinder Thind [mailto:xxxxx@windows.microsoft.com]
> Sent: Tuesday, April 13, 2004 11:39 AM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] FSRTL_FLAG_USER_MAPPED_FILE
>
> Ken,
>
> If you are seeing this flag set in the file object then it was memory
mapped
> for sure. It may be possible that the application you are using did not
> memory map while writing to it but someone surely did memory map it at
some
> time ealier. Like for e.g notepad memory maps the file for reading and
when
> you write to it, it does cached writes.
>
> Thanks
> Ravinder
> –
> This posting is provided “AS IS” with no warranties, and confers no
rights.
>
> “Ken Galipeau” wrote in message news:xxxxx@ntfsd…
> > I see the FSRTL_FLAG_USER_MAPPED_FILE bit being set on a stream file as
it
> > is begin closed. The application that open and then wrote the stream has
> NOT
> > memory mapped the stream or the base file. Can someone tell me why this
> is
> > happening?
> >
> >
> >
> > Thanks,
> >
> > Ken
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@legato.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@legato.com
To unsubscribe send a blank email to xxxxx@lists.osr.com