Hi,
I have a filter driver, which streams the data of “dummy” files from a remote server. When the application opens the file for the first time I bring the first PAGE_SIZE bytes from the server and save them to the file (this is done because I noticed that sometimes I don’t see the IRP_MJ_READ for the first PAGE_SIZE on NTFS - I think it has something to do with the fact that some of the data of the file might be actually saved as part of the MFT entry). To avoid reentrancy I direct the ZwCreateFile to my phantom device. The problem is that on NT 4.0 I don’t see the last IRP_MJ_CLOSE of the file when it is deleted (I know that the last IRP_MJ_CLOSE can arrive after minutes/hours/days/weeks… since the file was first opened, but when you delete it you should get the it). By the last IRP_MJ_CLOSE I mean the close with the DataSectionObject and the SectionObjectPointer in the SectionObjectPointer structure equal to NULL. This obviously causes a serious problem with all my data structures. I believe that the problem is that on NT 4.0 there is some “streamed” FO created by the cache manager with my phantom device as the related device, and that the last close is directed to my phantom device and not to my “main” device. I even think that I might see this problem on 2K/XP and I am only “stupidly lucky” as of now.
I have several questions. First, is my theory about the last IRP_MJ_CLOSE sent to the phantom device makes sense? If not what can be the reason for that? If it does make sense how can I solve this problem? I don’t want to roll my own IRP_MJ_CREATE, and I don’t want to deal with reentrancy. Is there a way to solve that? Did anybody encounter this problem?
Thanks,
Gilad Ben-Zeev