Handling the unknown

NTFSD
1

I am developing a filter for a client to do a clustered file system. What
are peoples suggestions for handling those operations where you have not
seen the IRP_MJ_CREATE and therefore not created a context. There is a need
to monitor and control as much as possible the I/O to the cluster including
updates to things like the MFT.

For normal operation Create sets a stream and a streamhandle context for my
filter, but understandibly we still see some raw FILE_OBJECTS with no
related data. How have other people addressed this? Just attaching
contexts at the first encounter would seem to have a lot of potential
cleanup problems.

Don Burn

2

If I see a file object for the first time and it isn’t a create, I
create a context at that point, initialize it the best I can and mark it
as ‘grandfathered’ (which lets everyone else ‘know’ it was seen after
the create). I have not had any problems (yet) with clean up, but my
filter probably isn’t as complicated as what may be required for your
application.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Wednesday, May 10, 2006 3:10 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Handling the unknown

I am developing a filter for a client to do a clustered file system.
What
are peoples suggestions for handling those operations where you have
not
seen the IRP_MJ_CREATE and therefore not created a context.
There is a need to monitor and control as much as possible the I/O to
the
cluster including updates to things like the MFT.

For normal operation Create sets a stream and a streamhandle
context for my filter, but understandibly we still see some raw
FILE_OBJECTS with no
related data. How have other people addressed this? Just attaching
contexts at the first encounter would seem to have a lot of potential
cleanup problems.