Dear all,
Thank you for your precious time first.
When we want to read a file first time, we usually use CreateFile, ReadFile API in application layer. After CreateFile executed and just before ReadFile, we can track the NonCache Read IRPs, the Read-ahead mechanism can account for this phenomenon.
If we read file first time,when FSD complete Create IRP,it immediately notify Cc to read the file data ahead(cause the first NonCache Read IRP).Am I right?
I am now doing a filter driver based sfilter,I use generic table to track file open instance from application,using the FsContext as key to counting the open FileObject(not include stream file object created by system).In the create routine of my filter,before per file structure(includes FsContext) to be inserted to generic table,I have to call FSD to initialize the FsContext of FileObject. According to my debug result, just after FSD return the Create IRP result to filter,but before the executing of generic table inserting code in my filter’s create routine, the first noncache Read IRP issued and my filter jump to run read routine without FsContext in table.
So my question is: How can I ensure that the create routine has completed the FsContext insertion when execute the read routine?
The key code segment follows up:
Create routine:
//Initialize FsContext of FileObject
status =ForwardIrpSyncronously(devExt->AttachedToDeviceObject, Irp);
if (NT_SUCCESS(status) && (STATUS_REPARSE != status) )
{
PFILE_CONTEXT FileCtxPtr2 = NULL;
BOOLEAN NewElement = FALSE;
FileCtxPtr->FsContext = irpSp->FileObject->FsContext;
ExAcquireFastMutex(&devExt->FsCtxTableMutex);
FileCtxPtr2= RtlLookupElementGenericTable(&devExt->FsCtxTable, &FileCtxHdr);
if (FileCtxPtr2)
++FileCtxPtr2->RefCount;
else
{
FileCtxPtr2 = RtlInsertElementGenericTable(&devExt->FsCtxTable, FileCtxPtr, sizeof(FILE_CONTEXT),&NewElement);
FileCtxPtr2->RefCount = 1;
ASSERT(&fileName->Name);
}
ExReleaseFastMutex(&devExt->FsCtxTableMutex);
}
read routine:
…
ExAcquireFastMutex(&devExt->FsCtxTableMutex);
KdPrint((“Look up table…\n”));
FileCtxHdr.FsContext = FileObject->FsContext;
FileCtxPtr = RtlLookupElementGenericTable(&devExt->FsCtxTable, &FileCtxHdr);
ExReleaseFastMutex(&devExt->FsCtxTableMutex);
if (!FileCtxPtr)
{
//for first NonCache read IRP,always execute the following code,because FsConext is not in generic table.
if(Irp->Flags==0x43)
KdPrint((“not capture the 0x43 Read IRP, fscontext not in table…\n”));
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(devExt->NLExtHeader.AttachedToDeviceObject, Irp);
}
…Process read data…
…
Thanks for any suggestion.
Stephen Li