MmForceSectionClosed() ?

NTFSD
1

Hi All,

Does anyone know what MmForceSectionClosed *exactly* does?

I am asking this as I am having the following bizzare situation: For a fileobject with a brief life cycle (the file is being queried/read by Windows Explorer when selected) I get the following sequence of IRPs

MJ_CREATE
MJ_CLEANUP
(as the last handle is being closed:

  • CcFlushCache
  • (MmFlushImageSection not needed - ImageSectionObject is NULL)
  • CcPurgeCacheSection - returning TRUE (DataSectionObject is non-NULL)
  • CcUninitializeCacheMap - returning FALSE - maybe because it was not paired with a CcInitialize…)
    MJ_READ
    MJ_READ
    (NO MJ_CLOSE!)

However, if I insert the call (second parameter must be TRUE):

MmForceSectionClosed( &p_fcb->sect_obj_pointers, TRUE );

between CcPurge… and CcUninitialize, then the MJ_CLOSE does get invoked after the two MJ_READs.

Perhaps even more strangely, MmForceSectionClosed() returns FALSE, which should indicate failure…

Does anyone have an explanation for this?

The docs I’ve found about MmForceSectionClosed() do not say much - MSDNs description in particular is very brief - so I can’t figure out the following:

  • what resources must I (not) be holding when calling the function
  • in what cases (for which open filestreams) it should be called and when (in what IRPs - cleanup?, and in what order, relating to CcFlushCache, MmFlushImageSection, CcPurge… CcUninitialize…)
  • why/how could a failed (returning FALSE) MmForceSectionClosed() cause a section object to be torn when no longer needed so that MJ_CLOSE is invoked. Does it set a flag or something? Why would this not happen “volunarily” but “forcefully”… totally confused.

Thanks,
Theodor

2

> Does anyone know what MmForceSectionClosed *exactly* does?

MmForceSectionClosed marks ControlArea, which is related with the segment
object backed by your FSD file object, to be deleted as the last
view/section is closed and the reference count drops to zero. If Control
Area is not marked as should be deleted it is saved( i.e. cached ) if there
is enough physical memory even if there is no any reference to it.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> Hi All,
>
> Does anyone know what MmForceSectionClosed exactly does?
>
> I am asking this as I am having the following bizzare situation: For a
> fileobject with a brief life cycle (the file is being queried/read by
> Windows Explorer when selected) I get the following sequence of IRPs
>
> MJ_CREATE
> MJ_CLEANUP
> (as the last handle is being closed:
> - CcFlushCache
> - (MmFlushImageSection not needed - ImageSectionObject is NULL)
> - CcPurgeCacheSection - returning TRUE (DataSectionObject is non-NULL)
> - CcUninitializeCacheMap - returning FALSE - maybe because it was not
> paired with a CcInitialize…)
> MJ_READ
> MJ_READ
> (NO MJ_CLOSE!)
>
> However, if I insert the call (second parameter must be TRUE):
>
> MmForceSectionClosed( &p_fcb->sect_obj_pointers, TRUE );
>
> between CcPurge… and CcUninitialize, then the MJ_CLOSE does get invoked
> after the two MJ_READs.
>
> Perhaps even more strangely, MmForceSectionClosed() returns FALSE, which
> should indicate failure…
>
> Does anyone have an explanation for this?
>
> The docs I’ve found about MmForceSectionClosed() do not say much - MSDNs
> description in particular is very brief - so I can’t figure out the
> following:
>
> - what resources must I (not) be holding when calling the function
> - in what cases (for which open filestreams) it should be called and when
> (in what IRPs - cleanup?, and in what order, relating to CcFlushCache,
> MmFlushImageSection, CcPurge… CcUninitialize…)
> - why/how could a failed (returning FALSE) MmForceSectionClosed() cause a
> section object to be torn when no longer needed so that MJ_CLOSE is
> invoked. Does it set a flag or something? Why would this not happen
> “volunarily” but “forcefully”… totally confused.
>
> Thanks,
> Theodor
>
>
>