Mini filter and Clearcase and Memory mapped api's

Hi,

I am new to developing device drivers / file system drivers / mini
filters. I have following basic questions.

  1. Documentation

Could someone point me to a getting started document / book on
file system filter drivers?

  1. Memory mapped api’s and Mini filter

I have developed a simple mini filter that changes the beginning offset of
the file (i.e. the first six characters are skipped before the file is
read). The filter works fine with command line utilities like VC++ compiler
(cl.exe), commands like type. However, this does not work in case of
Notepad.exe. As per my understanding (please correct me if I am wrong) the
cl.exe uses windows API’s like fread and hence work properly with my mini
filter. However, Notepad.exe uses the memory mapped API’s which do not go
through the file system driver. Hence my mini filter does not work with
Notepad.exe. How do I proceed here? What are the steps needed to handle
memory mapped API’s?

  1. Clearcase and Mini filter

The mini filter developed above works for utilities like cl.exe and
commands like type on the normal drives (e.g. C:).

However, if the file is present in the ClearCase drive (e.g. Z:)
these utilities do not work. Does Clearcase MVFS (multi-

Version file system) interfere here? How do I go about his?

Please let me know if you require any information on the same. Thanks
in advance.

Thanks and Best Regards,

Vishal

To handle the memory mapped files you must filter IRP_MJ_READ/WRITE requests which have an IRP_PAGING_IO flag set. The VMM is an FSD client, therefore it uses the same IRP_MJ_READ/WRITE requests as other clients do.
“Vishal Pai” wrote in message news:xxxxx@ntfsd…
Hi,

I am new to developing device drivers / file system drivers / mini filters. I have following basic questions.

1. Documentation

Could someone point me to a getting started document / book on file system filter drivers?

2. Memory mapped api’s and Mini filter

I have developed a simple mini filter that changes the beginning offset of the file (i.e. the first six characters are skipped before the file is read). The filter works fine with command line utilities like VC++ compiler (cl.exe), commands like type. However, this does not work in case of Notepad.exe. As per my understanding (please correct me if I am wrong) the cl.exe uses windows API’s like fread and hence work properly with my mini filter. However, Notepad.exe uses the memory mapped API’s which do not go through the file system driver. Hence my mini filter does not work with Notepad.exe. How do I proceed here? What are the steps needed to handle memory mapped API’s?

3. Clearcase and Mini filter

The mini filter developed above works for utilities like cl.exe and commands like type on the normal drives (e.g. C:).

However, if the file is present in the ClearCase drive (e.g. Z:) these utilities do not work. Does Clearcase MVFS (multi-

Version file system) interfere here? How do I go about his?

Please let me know if you require any information on the same. Thanks in advance.

Thanks and Best Regards,

Vishal

Could you please elaborate a little? There are a few cases which I am
worrying about.

  1. When I open a file in notepad then IRP_MJ_READ operation is trapped in my
    filter. However PAGING I/O flag is not set (Tried printing it).

  2. When I open it with notepad.exe from command prompt then IRP_MJ_READ
    operation is not at all trapped (i.e. I do not get any call in my function).

  3. When I edit a file with right click this results in the same as mentioned
    in point 2.

Am I missing something out here? Also could you provide an example code to
handle the memory mapped api’s.

Thanks,

Ruhina


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
Sent: Thursday, March 16, 2006 6:40 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Mini filter and Clearcase and Memory mapped api’s

To handle the memory mapped files you must filter IRP_MJ_READ/WRITE requests
which have an IRP_PAGING_IO flag set. The VMM is an FSD client, therefore it
uses the same IRP_MJ_READ/WRITE requests as other clients do.

“Vishal Pai” wrote in message
news:xxxxx@ntfsd…

Hi,

I am new to developing device drivers / file system drivers / mini
filters. I have following basic questions.

1. Documentation

Could someone point me to a getting started document / book on
file system filter drivers?

2. Memory mapped api’s and Mini filter

I have developed a simple mini filter that changes the beginning offset of
the file (i.e. the first six characters are skipped before the file is
read). The filter works fine with command line utilities like VC++ compiler
(cl.exe), commands like type. However, this does not work in case of
Notepad.exe. As per my understanding (please correct me if I am wrong) the
cl.exe uses windows API’s like fread and hence work properly with my mini
filter. However, Notepad.exe uses the memory mapped API’s which do not go
through the file system driver. Hence my mini filter does not work with
Notepad.exe. How do I proceed here? What are the steps needed to handle
memory mapped API’s?

3. Clearcase and Mini filter

The mini filter developed above works for utilities like cl.exe and
commands like type on the normal drives (e.g. C:).

However, if the file is present in the ClearCase drive (e.g. Z:)
these utilities do not work. Does Clearcase MVFS (multi-

Version file system) interfere here? How do I go about his?

Please let me know if you require any information on the same. Thanks
in advance.

Thanks and Best Regards,

Vishal


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

In the second case( point 2 ) the read may be done using the Fast IO, because the file is already in the cache and the Fast IO is allowed in the FsContext.

Let us consider a situation then a file is opened for the first time by a program, which does not map this file and uses NtReadFile to read it.
The program opens a file and sends an IRP_MJ_READ, the FSD calls CcInitializeCacheMap, which( CcInitializeCacheMap ) creates a segment and a section( i.e. maps view of the file ), then FSD calls CcReadFile, page fault occurs and page is read using IRP_MJ_READ with PAGING flag set. Then you may close the file’s handle( i.e to call NtClose ) , but the cache manger does not close the section object, this means that the data section still exists and the pages may be in the physical memory( i.e. resident pages ). This section will be flushed later ( if there is shortage of physical pages ) and then closed during removing of the cache map. Now we have the valid section and segment and possibly the valid pages for this segment, we also have the valid cache map.
And now let us consider a situation then a file is opened for the first time by a program and mapped. The segment and section objects are also created, and when the section object is closed the system marks the segment object as unused, but it does not delete it immediatelly if there are valid pages in it, because this segment may be reused in the nearest future.
As you can see in both cases you have the valid segment object for a some period of time and ( with some probability ) valid pages for that segment, therefore there is no need to read this pages when you maps the file in the second time or read it using the Fast IO . But in any case, you MUST observe an IRP_MJ_READ request with the paging flag set, check the sequence in which you access the file.

“ruhina” wrote in message news:xxxxx@ntfsd…
Could you please elaborate a little? There are a few cases which I am worrying about.

1. When I open a file in notepad then IRP_MJ_READ operation is trapped in my filter. However PAGING I/O flag is not set (Tried printing it).

2. When I open it with notepad.exe from command prompt then IRP_MJ_READ operation is not at all trapped (i.e. I do not get any call in my function).

3. When I edit a file with right click this results in the same as mentioned in point 2.

Am I missing something out here? Also could you provide an example code to handle the memory mapped api’s.

Thanks,

Ruhina

------------------------------------------------------------------------------

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
Sent: Thursday, March 16, 2006 6:40 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Mini filter and Clearcase and Memory mapped api’s

To handle the memory mapped files you must filter IRP_MJ_READ/WRITE requests which have an IRP_PAGING_IO flag set. The VMM is an FSD client, therefore it uses the same IRP_MJ_READ/WRITE requests as other clients do.

“Vishal Pai” wrote in message news:xxxxx@ntfsd…

Hi,

I am new to developing device drivers / file system drivers / mini filters. I have following basic questions.

1. Documentation

Could someone point me to a getting started document / book on file system filter drivers?

2. Memory mapped api’s and Mini filter

I have developed a simple mini filter that changes the beginning offset of the file (i.e. the first six characters are skipped before the file is read). The filter works fine with command line utilities like VC++ compiler (cl.exe), commands like type. However, this does not work in case of Notepad.exe. As per my understanding (please correct me if I am wrong) the cl.exe uses windows API’s like fread and hence work properly with my mini filter. However, Notepad.exe uses the memory mapped API’s which do not go through the file system driver. Hence my mini filter does not work with Notepad.exe. How do I proceed here? What are the steps needed to handle memory mapped API’s?

3. Clearcase and Mini filter

The mini filter developed above works for utilities like cl.exe and commands like type on the normal drives (e.g. C:).

However, if the file is present in the ClearCase drive (e.g. Z:) these utilities do not work. Does Clearcase MVFS (multi-

Version file system) interfere here? How do I go about his?

Please let me know if you require any information on the same. Thanks in advance.

Thanks and Best Regards,

Vishal


Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Could you please provide some sample code for handling memory mapped Apis
…i.e skipping 6 bytes from a file being opened with Notepad.

Regards,

Ruhina


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
Sent: Friday, March 17, 2006 3:19 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Mini filter and Clearcase and Memory mapped api’s

In the second case( point 2 ) the read may be done using the Fast IO,
because the file is already in the cache and the Fast IO is allowed in the
FsContext.

Let us consider a situation then a file is opened for the first time by a
program, which does not map this file and uses NtReadFile to read it.

The program opens a file and sends an IRP_MJ_READ, the FSD calls
CcInitializeCacheMap, which( CcInitializeCacheMap ) creates a segment and a
section( i.e. maps view of the file ), then FSD calls CcReadFile, page fault
occurs and page is read using IRP_MJ_READ with PAGING flag set. Then you may
close the file’s handle( i.e to call NtClose ) , but the cache manger does
not close the section object, this means that the data section still exists
and the pages may be in the physical memory( i.e. resident pages ). This
section will be flushed later ( if there is shortage of physical pages ) and
then closed during removing of the cache map. Now we have the valid section
and segment and possibly the valid pages for this segment, we also have the
valid cache map.

And now let us consider a situation then a file is opened for the first
time by a program and mapped. The segment and section objects are also
created, and when the section object is closed the system marks the segment
object as unused, but it does not delete it immediatelly if there are valid
pages in it, because this segment may be reused in the nearest future.

As you can see in both cases you have the valid segment object for a some
period of time and ( with some probability ) valid pages for that segment,
therefore there is no need to read this pages when you maps the file in the
second time or read it using the Fast IO . But in any case, you MUST observe
an IRP_MJ_READ request with the paging flag set, check the sequence in which
you access the file.

“ruhina” wrote in message
news:xxxxx@ntfsd…

Could you please elaborate a little? There are a few cases which I am
worrying about.

1. When I open a file in notepad then IRP_MJ_READ operation is trapped in my
filter. However PAGING I/O flag is not set (Tried printing it).

2. When I open it with notepad.exe from command prompt then IRP_MJ_READ
operation is not at all trapped (i.e. I do not get any call in my function).

3. When I edit a file with right click this results in the same as mentioned
in point 2.

Am I missing something out here? Also could you provide an example code to
handle the memory mapped api’s.

Thanks,

Ruhina

_____

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
Sent: Thursday, March 16, 2006 6:40 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Mini filter and Clearcase and Memory mapped api’s

To handle the memory mapped files you must filter IRP_MJ_READ/WRITE requests
which have an IRP_PAGING_IO flag set. The VMM is an FSD client, therefore it
uses the same IRP_MJ_READ/WRITE requests as other clients do.

“Vishal Pai” wrote in message
news:xxxxx@ntfsd…

Hi,

I am new to developing device drivers / file system drivers / mini
filters. I have following basic questions.

1. Documentation

Could someone point me to a getting started document / book on
file system filter drivers?

2. Memory mapped api’s and Mini filter

I have developed a simple mini filter that changes the beginning offset of
the file (i.e. the first six characters are skipped before the file is
read). The filter works fine with command line utilities like VC++ compiler
(cl.exe), commands like type. However, this does not work in case of
Notepad.exe. As per my understanding (please correct me if I am wrong) the
cl.exe uses windows API’s like fread and hence work properly with my mini
filter. However, Notepad.exe uses the memory mapped API’s which do not go
through the file system driver. Hence my mini filter does not work with
Notepad.exe. How do I proceed here? What are the steps needed to handle
memory mapped API’s?

3. Clearcase and Mini filter

The mini filter developed above works for utilities like cl.exe and
commands like type on the normal drives (e.g. C:).

However, if the file is present in the ClearCase drive (e.g. Z:)
these utilities do not work. Does Clearcase MVFS (multi-

Version file system) interfere here? How do I go about his?

Please let me know if you require any information on the same. Thanks
in advance.

Thanks and Best Regards,

Vishal


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com