Minifilter IO in arbitrary context

I am porting my (stable, released) NT4/W2K/XP legacy filter driver to a
minifilter. The driver frequently needs to access files (previously opened
in system context) in arbitrary context. The legacy driver uses ZwCreateFile
and ObReferenceObjectByHandle to open the files and then subsequently posts
async roll-your-own IRP_MJ_READ IRPs - this technique works well.

In the mini-filter, I tried using this technique with handles obtained via
FltCreateFile, but the IRP_MJ_READ returns a STATUS_INVALID_PARAMETER.

I guess that the “correct” way is to use FltCreateFile with the
OBJ_KERNEL_HANDLE specified in the object attributes. And thereafter I can
use ZwReadFile on this handle in arbitrary context - avoiding the explicit
IRPs completely.

Is this correct? And will this technique still give me adequate performance?

Thanks

Brian

You should be able to use ObReferenceObjectByHandle to get the file
object from the handle returned to you by FltCreateFile then use that to
call FltReadFile to do your async read.

Could you tell me the parameters you used when opening the handle using
FltCreateFile and the parameter you used when calling FltReadFile?
Also, are you using the FRE or CHK fltmgr.sys?

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Brian Collins
Sent: Thursday, April 15, 2004 7:37 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter IO in arbitrary context

I am porting my (stable, released) NT4/W2K/XP legacy filter driver to a
minifilter. The driver frequently needs to access files (previously
opened in system context) in arbitrary context. The legacy driver uses
ZwCreateFile and ObReferenceObjectByHandle to open the files and then
subsequently posts async roll-your-own IRP_MJ_READ IRPs - this technique
works well.

In the mini-filter, I tried using this technique with handles obtained
via FltCreateFile, but the IRP_MJ_READ returns a
STATUS_INVALID_PARAMETER.

I guess that the “correct” way is to use FltCreateFile with the
OBJ_KERNEL_HANDLE specified in the object attributes. And thereafter I
can use ZwReadFile on this handle in arbitrary context - avoiding the
explicit IRPs completely.

Is this correct? And will this technique still give me adequate
performance?

Thanks

Brian


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks Molly,

I had not tried FltReadFile - I was discouraged by the documentation “While
it is possible for a minifilter to use routines such as FltReadFile and
FltWriteFile to perform I/O on files opened by the minifilter itself, doing
so is not recommended”. Perhaps if there are valid reasons to do this, the
warning in the help could be toned down.

I will try this and post again once I know whether it works for me.

Brian

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
You should be able to use ObReferenceObjectByHandle to get the file
object from the handle returned to you by FltCreateFile then use that to
call FltReadFile to do your async read.

Could you tell me the parameters you used when opening the handle using
FltCreateFile and the parameter you used when calling FltReadFile?
Also, are you using the FRE or CHK fltmgr.sys?

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Brian Collins
Sent: Thursday, April 15, 2004 7:37 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter IO in arbitrary context

I am porting my (stable, released) NT4/W2K/XP legacy filter driver to a
minifilter. The driver frequently needs to access files (previously
opened in system context) in arbitrary context. The legacy driver uses
ZwCreateFile and ObReferenceObjectByHandle to open the files and then
subsequently posts async roll-your-own IRP_MJ_READ IRPs - this technique
works well.

In the mini-filter, I tried using this technique with handles obtained
via FltCreateFile, but the IRP_MJ_READ returns a
STATUS_INVALID_PARAMETER.

I guess that the “correct” way is to use FltCreateFile with the
OBJ_KERNEL_HANDLE specified in the object attributes. And thereafter I
can use ZwReadFile on this handle in arbitrary context - avoiding the
explicit IRPs completely.

Is this correct? And will this technique still give me adequate
performance?

Thanks

Brian


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Yes, we are already working on changing the wording in the FltReadFile
docs to make it more clear when you should and shouldn’t use it.

Rolling an IRP from a minifilter is a bad idea. The main reason folks
did this in the past is to redirect the IO below them and a minifilter
cannot do this properly. That’s the reason the filter manager provides
FltReadFile, FltWriteFile, etc., and the “primitives”
FltPerformAsynchronousIo and FltPerformSynchronousIo.

You should be able to do your async read either by using FltReadFile or
ZwReadFile. FltReadFile gives you the ability to send your read to
filters below you regardless of how the file object was opened.
ZwReadFile starts the read at the appropriate point in the stack based
on how the file object was opened. If it was opened via FltCreateFile,
it will start just below the Instance who opened it (just like
IoCreateFileSpecifyDeviceObjectHint).

Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Brian Collins
Sent: Thursday, April 15, 2004 9:28 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Minifilter IO in arbitrary context

Thanks Molly,

I had not tried FltReadFile - I was discouraged by the documentation
“While it is possible for a minifilter to use routines such as
FltReadFile and FltWriteFile to perform I/O on files opened by the
minifilter itself, doing so is not recommended”. Perhaps if there are
valid reasons to do this, the warning in the help could be toned down.

I will try this and post again once I know whether it works for me.

Brian

“Molly Brown” wrote in message
news:xxxxx@ntfsd…
You should be able to use ObReferenceObjectByHandle to get the file
object from the handle returned to you by FltCreateFile then use that to
call FltReadFile to do your async read.

Could you tell me the parameters you used when opening the handle using
FltCreateFile and the parameter you used when calling FltReadFile?
Also, are you using the FRE or CHK fltmgr.sys?

Thanks,
Molly Brown
Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Brian Collins
Sent: Thursday, April 15, 2004 7:37 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter IO in arbitrary context

I am porting my (stable, released) NT4/W2K/XP legacy filter driver to a
minifilter. The driver frequently needs to access files (previously
opened in system context) in arbitrary context. The legacy driver uses
ZwCreateFile and ObReferenceObjectByHandle to open the files and then
subsequently posts async roll-your-own IRP_MJ_READ IRPs - this technique
works well.

In the mini-filter, I tried using this technique with handles obtained
via FltCreateFile, but the IRP_MJ_READ returns a
STATUS_INVALID_PARAMETER.

I guess that the “correct” way is to use FltCreateFile with the
OBJ_KERNEL_HANDLE specified in the object attributes. And thereafter I
can use ZwReadFile on this handle in arbitrary context - avoiding the
explicit IRPs completely.

Is this correct? And will this technique still give me adequate
performance?

Thanks

Brian


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com