How to read a file on a network drive from post create callback?

NTFSD
1

Hi all,
I am trying to get all the file events from a network drive, I get the events but when I try to read the file by calling FltReadFile I get invalid handel. File events from other disk works fine.

I am running on a Windows 2003 R2 x86 machine, when I run the driver in windows 7 it works fine, so it seems to be a windows 2003 problem.

The events are received in post create callback and I am using the cancel-safe queues, and it is in the cancel safe work item routine I am calling the FltReadFile method.

FltReadFile( InstCtx->Instance, Data->Iopb->TargetFileObject, &byteOffset, Length, buffer, FLTFL_IO_OPERATION_NON_CACHED | FLTFL_IO_OPERATION_DO_NOT_UPDATE_BYTE_OFFSET, &bytesRead, NULL, NULL );

My question is if it is possible to read a file from a network disk like I do in cancel safe work item routine on a windows server 2003 machine?
Or can/should I do it in some other way?

Thanks
/Mattias Lasu

2

>the cancel safe work item routine I am calling the FltReadFile method.

I think the queue’s consumer is running on DISPATCH, and FltReadFile requires PASSIVE?

Isn’t it so?

Why do you need a CSQ for filesystem IO?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

3

Thanks for the answer Maxim.

Yes FltReadFile requires PASSIVE_LEVEL but are you sure that the queue?s consumer is running on DISPATCH_LEVEL? If so I thought that I should have BSOD if I call FltReadFile on a wrong level, or have I wrong?

I have some performance issue so I implement the CSQ. I do not see any performance boost after implementing CSQ but I thought it was better to have this queue, it sounds like a good idea. Is it wrong to implement the CSQ in my case do you think? I have running the Verifier and simulate wrong IRQL, all working fine, no issues.

I see that I have the same issue on a Windows 7 machine so it was not only a server 2003 issue. The problem is that when I open a file on a network disk several events are received but the first events FltReadFile returned with invalid handle. But after the third event I successfully called the FltReadFile and everyone is happy :slight_smile:

Thanks
/Mattias

4

No, the routine isn’t called at dispatch. I’m not sure why you need the CSQ though so I can’t comment on whether it’s a good idea.

What do you mean by “the events are received in post create callback”? Are you talking about minifilter events ? They should all arrive in their respective callbacks… Could you please describe what you driver is doing and how it’s using the CSQ?

What are the “events” that you see when you open a file ? You just say " when I open a file on a network disk several events are received" which isn’t enough information…

Thanks,
Alex.

5

> I have some performance issue so I implement the CSQ. I do not see any performance boost after

implementing CSQ but I thought it was better to have this queue, it sounds like a good idea. Is it
wrong to implement the CSQ in my case do you think?

Except some marginal scenarios like cancelling CREATE requests to the SMB server in Vista+, FS stacks do not use CSQ. More so, disk storage stack does not use CSQ either.

So, your own CSQ in this world will provide no gain - the IRPs will be stuck in other non-cancellable queue.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

6

Thanks again for all the answers.

Trying to explain what I am doing:
I try to get all the file events in Post operation callback method in a minifilter driver and put them in the CSQ to postpone the event. The events are handled in the CSQ work item routine, there I tried to read 40 bytes from the file by FltReadFile. These 40 bytes are sent to User Mode (UM) to evaluate the bytes and return if it is safe to open or not (exact as the Scanner example from WinDDK except the CSQ). I thought that because the call to UM could take some time it would be best to use a queue to put all the file events to get better performance.

Here comes the issue, when a user opens a file on a network disk I received several events in post operation callback and all are for the same file. For some of these events FltReadFile fails with invalid handle. I wonder if network discs are a ?special disc? and therefore I should only accept the issue and there are nothing else to do, or is it?

Thanks
Mattias Lasu

7

I’m pretty sure this is unrelated, but it is can be a really bad idea to use
the fileobject you get presented with in PostCreate to do a FltRead.

If you have to do this you should take steps to make sure that the file
object is not a stack based FO. This can certainly happen in WXP and Vista,
I haven’t looked to see whether they are still there in Win7.

8

I want to know how to develop drivers, please help me

9

You hijack some ones thread to ask a redundant question that has been asked thousands of times and answered ten thousand times? That’s rude, dude.

Get the WDK.

Gary Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

On Dec 4, 2011, at 8:41 AM, Dibu Das wrote:

I want to know how to develop drivers, please help me

— NTFSD is sponsored by OSR For our schedule of debugging and file system seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

Did you ever consider the simple expedient of getting the WDK and reading
the documentation?

Buy all the good books on writing drivers and read them, cover to cover.

Buy books about the PCI standards, USB standards, 1394 standards, how
computers work, bus structures, etc. and read them. You can’t ignore the
realities of hardware. You CAN ignore a lot of the details, once you have
figured out what details are ignorable.

Then consider a course (OSR teaches them).

You have not stated your background, whether or not you have ever written
a device driver for any system, ever, what your familiarity is with
hardware, low-level programming, bus architectures, firmware, etc. so
there is no way to direct you to the materials you might need to fill in
the gaps in your experience.

Did you ever consider that this is like going to a professional
programmers’ forum and asking “I want to learn to program, please help
me”?

There are limits to how foolish a question can be before I respond with
such annoyance, but this question is well over threshold.

By the way, I’d like to learn SQL coding. Can you help me? And can you
explain to me how I can do it from a database on a network drive, from the
postcreate callback?
joe

I want to know how to develop drivers, please help me

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer