Dear all,
I am not sure about the different between IRP_MJ_CLEANUP and IRP_MJ_CLOSE.
The fast-fat sample in IFS said that after FSD processed the IRP_MJ_CLEANUP
there are still references to this file object existing in kernel mode.
Then, is this situation may occur or never occur:
After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
?
Thanks for any answer.
Laura.
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com
IRP_MJ_CLEANUP is sent down then the HANDLE count of the file object
drops to 0. IRP_MJ_CLOSE is sent when the reference count drops to 0.
This is a basic principle of the Object Manager called object retention.
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 8:37 PM
Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> Dear all,
>
> I am not sure about the different between IRP_MJ_CLEANUP and IRP_MJ_CLOSE.
> The fast-fat sample in IFS said that after FSD processed the
IRP_MJ_CLEANUP
> there are still references to this file object existing in kernel mode.
> Then, is this situation may occur or never occur:
> After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> ?
>
> Thanks for any answer.
>
> Laura.
>
>
>
>
> _________________________________________________________
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
After a IRP_MJ_CLEANUP is sent down on a file object, only paging operations
are allowed on it. Usuarlly thier origin is in the Memory manager.Thats why
you keep seeing IRP_MJ_WRITE amd so on
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 8:37 PM
Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> Dear all,
>
> I am not sure about the different between IRP_MJ_CLEANUP and IRP_MJ_CLOSE.
> The fast-fat sample in IFS said that after FSD processed the
IRP_MJ_CLEANUP
> there are still references to this file object existing in kernel mode.
> Then, is this situation may occur or never occur:
> After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> ?
>
> Thanks for any answer.
>
> Laura.
>
>
>
>
> _________________________________________________________
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
Is that means the kernel still can modify this file after IRP_MJ_CLEANUP?
Because if user or kernel modify the file I need to modify it’s copy file
accordingly. Then I should close the copy file after there are no more irp
to this file. but I 'm not sure where I shold close my copy file handle.
after recieve IRP_MJ_CLOSE or IRP_MJ_CLEANUP.
Thanks.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
Sent: Friday, June 21, 2002 1:45 PM
To: File Systems Developers
Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
IRP_MJ_CLEANUP is sent down then the HANDLE count of the file object
drops to 0. IRP_MJ_CLOSE is sent when the reference count drops to 0.
This is a basic principle of the Object Manager called object retention.
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 8:37 PM
Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> Dear all,
>
> I am not sure about the different between IRP_MJ_CLEANUP and IRP_MJ_CLOSE.
> The fast-fat sample in IFS said that after FSD processed the
IRP_MJ_CLEANUP
> there are still references to this file object existing in kernel mode.
> Then, is this situation may occur or never occur:
> After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> ?
>
> Thanks for any answer.
>
> Laura.
>
>
>
>
>
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
—
You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
To unsubscribe send a blank email to %%email.unsub%%
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com
after the IRP_MJ_CLEANUP, the OS still can modify the file. My question is,
what exactly are you trying to do ?
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 9:02 PM
Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
> Is that means the kernel still can modify this file after IRP_MJ_CLEANUP?
> Because if user or kernel modify the file I need to modify it’s copy file
> accordingly. Then I should close the copy file after there are no more irp
> to this file. but I 'm not sure where I shold close my copy file handle.
> after recieve IRP_MJ_CLOSE or IRP_MJ_CLEANUP.
>
> Thanks.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
> Sent: Friday, June 21, 2002 1:45 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> IRP_MJ_CLEANUP is sent down then the HANDLE count of the file object
> drops to 0. IRP_MJ_CLOSE is sent when the reference count drops to 0.
>
> This is a basic principle of the Object Manager called object retention.
>
>
> ----- Original Message -----
> From: “gaoren”
> To: “File Systems Developers”
> Sent: Friday, June 21, 2002 8:37 PM
> Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> > Dear all,
> >
> > I am not sure about the different between IRP_MJ_CLEANUP and
IRP_MJ_CLOSE.
> > The fast-fat sample in IFS said that after FSD processed the
> IRP_MJ_CLEANUP
> > there are still references to this file object existing in kernel mode.
> > Then, is this situation may occur or never occur:
> > After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> > IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> > ?
> >
> > Thanks for any answer.
> >
> > Laura.
> >
> >
> >
> >
> >
> >
> > Do You Yahoo!?
> >
> > Get your free @yahoo.com address at http://mail.yahoo.com
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
I need to do data protecting on a specific directory. When there are any
modification on a file in this directory, I need to reflect this
modification on the duplicated file which saved at another place.
Then there may be more than one process are modifing this file. I just
create a system thread in my filter driver, in which I do the reflection.
Every time my filter driver block any modification (no matter in what
process) it put this irp into a queqe and inform my system thread, then my
system thread get irp from the queqe and do reflection according to IRP and
IRP stack parameters.
For simple, I just keep one file handle and a file handle counter in my
system thread. when I receive a IRP_MJ_CREATE if the copy file allready been
opened and still in a list I just add the file handle counter. if there are
no file handle in the list then I open one.
Then I minus one on the copy file handle counter when my driver receive a
IRP_MJ_CLOSE or IRP_MJ_CLEANUP. After the counter reach 0, I close this file
handle.
( Becuase some complicated file type: *.doc, *.ppt, have intermediete files,
so I can not only block IRP_MJ_WRITE and write to the copy file. That does
not work. I have tried)
Is that right?
( I havn’t finished the project. met lots of problems.)
Thank you very much.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
Sent: Friday, June 21, 2002 2:03 PM
To: File Systems Developers
Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
after the IRP_MJ_CLEANUP, the OS still can modify the file. My question is,
what exactly are you trying to do ?
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 9:02 PM
Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
> Is that means the kernel still can modify this file after IRP_MJ_CLEANUP?
> Because if user or kernel modify the file I need to modify it’s copy file
> accordingly. Then I should close the copy file after there are no more irp
> to this file. but I 'm not sure where I shold close my copy file handle.
> after recieve IRP_MJ_CLOSE or IRP_MJ_CLEANUP.
>
> Thanks.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
> Sent: Friday, June 21, 2002 1:45 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> IRP_MJ_CLEANUP is sent down then the HANDLE count of the file object
> drops to 0. IRP_MJ_CLOSE is sent when the reference count drops to 0.
>
> This is a basic principle of the Object Manager called object retention.
>
>
> ----- Original Message -----
> From: “gaoren”
> To: “File Systems Developers”
> Sent: Friday, June 21, 2002 8:37 PM
> Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> > Dear all,
> >
> > I am not sure about the different between IRP_MJ_CLEANUP and
IRP_MJ_CLOSE.
> > The fast-fat sample in IFS said that after FSD processed the
> IRP_MJ_CLEANUP
> > there are still references to this file object existing in kernel mode.
> > Then, is this situation may occur or never occur:
> > After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> > IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> > ?
> >
> > Thanks for any answer.
> >
> > Laura.
> >
> >
> >
> >
> >
> >
> > Do You Yahoo!?
> >
> > Get your free @yahoo.com address at http://mail.yahoo.com
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
>
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>
—
You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
To unsubscribe send a blank email to %%email.unsub%%
_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com
This type of driver, file system filter, is one of the most difficult
drivers to write. The rules are only partially exposed in the IFS Kit.
- After a cleanup, only paging IO is permitted.
- In your copy of the file, only paging IO needs to be handled. Since you
don’t read from the copy, only paging writes apply.
- The various Office programs each use a different algorithm for their
files. Word is one of the easiest in that the original file is opened, a
temp file created, and the original file is closed. When the temp is closed
by using save, it deletes the original file and renames the temp file to the
original file. Powerpoint can place one of the temp files in the default
temp directory and then eventually put a temp file in the source file
directory. These rules are very complex and seem to change with various
versions of the programs.
- How are you handling the rename of the temp file to the original file?
You will not see any writes to the original file, but only to the temp
files. You may have to copy the file being renamed to your backup copy.
I have written this stuff and it can be a bear to get right. If you have an
encryption filter that will work with all of the Office applications, you
have one that will work with all programs. NotePad & WordPad are included
in the ‘Office’ suite for this purpose.
Is that means the kernel still can modify this file after IRP_MJ_CLEANUP?
Because if user or kernel modify the file I need to modify it’s copy file
accordingly. Then I should close the copy file after there are no more irp
to this file. but I 'm not sure where I shold close my copy file handle.
after receive IRP_MJ_CLOSE or IRP_MJ_CLEANUP.
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 2:30 PM
Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> I need to do data protecting on a specific directory. When there are any
> modification on a file in this directory, I need to reflect this
> modification on the duplicated file which saved at another place.
> Then there may be more than one process are modifing this file. I just
> create a system thread in my filter driver, in which I do the reflection.
> Every time my filter driver block any modification (no matter in what
> process) it put this irp into a queqe and inform my system thread, then my
> system thread get irp from the queqe and do reflection according to IRP
and
> IRP stack parameters.
> For simple, I just keep one file handle and a file handle counter in my
> system thread. when I receive a IRP_MJ_CREATE if the copy file allready
been
> opened and still in a list I just add the file handle counter. if there
are
> no file handle in the list then I open one.
> Then I minus one on the copy file handle counter when my driver receive a
> IRP_MJ_CLOSE or IRP_MJ_CLEANUP. After the counter reach 0, I close this
file
> handle.
>
> ( Becuase some complicated file type: *.doc, *.ppt, have intermediete
files,
> so I can not only block IRP_MJ_WRITE and write to the copy file. That does
> not work. I have tried)
>
> Is that right?
>
> ( I havn’t finished the project. met lots of problems.)
>
> Thank you very much.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
> Sent: Friday, June 21, 2002 2:03 PM
> To: File Systems Developers
> Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> after the IRP_MJ_CLEANUP, the OS still can modify the file. My question
is,
> what exactly are you trying to do ?
>
>
>
> ----- Original Message -----
> From: “gaoren”
> To: “File Systems Developers”
> Sent: Friday, June 21, 2002 9:02 PM
> Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
>
>
> >
> > Is that means the kernel still can modify this file after
IRP_MJ_CLEANUP?
> > Because if user or kernel modify the file I need to modify it’s copy
file
> > accordingly. Then I should close the copy file after there are no more
irp
> > to this file. but I 'm not sure where I shold close my copy file handle.
> > after recieve IRP_MJ_CLOSE or IRP_MJ_CLEANUP.
> >
> > Thanks.
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com]On Behalf Of Dan Partelly
> > Sent: Friday, June 21, 2002 1:45 PM
> > To: File Systems Developers
> > Subject: [ntfsd] Re: IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> >
> >
> > IRP_MJ_CLEANUP is sent down then the HANDLE count of the file object
> > drops to 0. IRP_MJ_CLOSE is sent when the reference count drops to 0.
> >
> > This is a basic principle of the Object Manager called object retention.
> >
> >
> > ----- Original Message -----
> > From: “gaoren”
> > To: “File Systems Developers”
> > Sent: Friday, June 21, 2002 8:37 PM
> > Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> >
> >
> > > Dear all,
> > >
> > > I am not sure about the different between IRP_MJ_CLEANUP and
> IRP_MJ_CLOSE.
> > > The fast-fat sample in IFS said that after FSD processed the
> > IRP_MJ_CLEANUP
> > > there are still references to this file object existing in kernel
mode.
> > > Then, is this situation may occur or never occur:
> > > After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> > > IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> > > ?
> > >
> > > Thanks for any answer.
> > >
> > > Laura.
> > >
> > >
> > >
> > >
> > >
> > >
> > > Do You Yahoo!?
> > >
> > > Get your free @yahoo.com address at http://mail.yahoo.com
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
> > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> >
> >
> >
> > Do You Yahoo!?
> >
> > Get your free @yahoo.com address at http://mail.yahoo.com
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yahoo.ca
> To unsubscribe send a blank email to %%email.unsub%%
>
>
>
> _________________________________________________________
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to %%email.unsub%%
Some of the operations will fail after cleanup with
STATUS_FILE_CLOSED. For instance, FSCTL_GET_VOLUME_BITMAP will fail if
DASD file was cleaned up.
The “cleanup complete” state of the file object assumes that
operations on it can occur mainly from Cc or Mm (user mappings).
Max
----- Original Message -----
From: “gaoren”
To: “File Systems Developers”
Sent: Friday, June 21, 2002 9:37 PM
Subject: [ntfsd] IRP_MJ_CLOSE via IRP_MJ_CLEANUP??
> Dear all,
>
> I am not sure about the different between IRP_MJ_CLEANUP and
IRP_MJ_CLOSE.
> The fast-fat sample in IFS said that after FSD processed the
IRP_MJ_CLEANUP
> there are still references to this file object existing in kernel
mode.
> Then, is this situation may occur or never occur:
> After IRP_MJ_CLEANUP, kernel keeps on modify the file: send out
> IRP_MJ_WRITE, IRP_MJ_SET_INFORMATION, IRP_FILE_SYSTEM_CONTROL, etc…
> ?
>
> Thanks for any answer.
>
> Laura.
>
>
>
>
> _________________________________________________________
>
> Do You Yahoo!?
>
> Get your free @yahoo.com address at http://mail.yahoo.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>