Does anyone know a way of getting the cache manager to dereference a file
object quickly before a call to IoCancelFileOpen?
Our filter driver is intercepting creates - passing the irp down to the
file system - and synchronising back to the original context via the
completion routine. It then uses the resulting file object to do read
operations. On the basis of those operations we may decide to cancel the
create request and we do this via IoCancelFileOpen.
At this point there are usually 3 outstanding references (I assume 2 are
cache manager and 1 is iomanger) on the file object. Calling
CcPurgeCacheSection causes the cache manager to dereference the file
object, but there seems to be quite a delay - of at least one second
between the call to CcPurgeCacheSection and the references actually
disappearing.
Is there a better way of getting the cache manager to drop the references?
Thanks
–
Steven Braggs, Software Engineer, Sophos Anti-Virus
Email: xxxxx@sophos.com, Tel: 01235 559933, Web: www.sophos.com
Add live virus info to your website: http://www.sophos.com/link/vfeed
// Uninitialize FO caching.
CcUninitializeCacheMap(FileObjectPtr, NULL, NULL);
// Flush cache.
CcFlushCache(&FcbPtr->SectionObjectPointers, NULL, 0, NULL);
// Flush image section if there is one.
if (FcbPtr->SectionObjectPointers.ImageSectionObject)
{
MmFlushImageSection(&FcbPtr->SectionObjectPointers, MmFlushForWrite);
}
// Purge cache section if there is one.
if (FcbPtr->SectionObjectPointers.DataSectionObject)
{
CcPurgeCacheSection(&FcbPtr->SectionObjectPointers, NULL, 0, FALSE);
}
----- Original Message -----
From:
To: “File Systems Developers”
Sent: Friday, March 07, 2003 11:38 AM
Subject: [ntfsd] More on IoCancelFileOpen
>
> Does anyone know a way of getting the cache manager to dereference a file
> object quickly before a call to IoCancelFileOpen?
>
> Our filter driver is intercepting creates - passing the irp down to the
> file system - and synchronising back to the original context via the
> completion routine. It then uses the resulting file object to do read
> operations. On the basis of those operations we may decide to cancel the
> create request and we do this via IoCancelFileOpen.
> At this point there are usually 3 outstanding references (I assume 2 are
> cache manager and 1 is iomanger) on the file object. Calling
> CcPurgeCacheSection causes the cache manager to dereference the file
> object, but there seems to be quite a delay - of at least one second
> between the call to CcPurgeCacheSection and the references actually
> disappearing.
>
> Is there a better way of getting the cache manager to drop the references?
>
> Thanks
>
> –
> Steven Braggs, Software Engineer, Sophos Anti-Virus
> Email: xxxxx@sophos.com, Tel: 01235 559933, Web: www.sophos.com
> Add live virus info to your website: http://www.sophos.com/link/vfeed
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
if i call CcFlushCache, then CcPurgeCacheSection followed by
CcUninitializeCacheMap, without MmFlushImageSection, will the effect be
drastically different?
btw, is MmFlushImageSection necessary if CcFlushCache is called? i thought
the image section is part of the cache?
Ampsi
----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Thursday, March 13, 2003 01:26
Subject: [ntfsd] Re: More on IoCancelFileOpen
// Uninitialize FO caching.
CcUninitializeCacheMap(FileObjectPtr, NULL, NULL);
// Flush cache.
CcFlushCache(&FcbPtr->SectionObjectPointers, NULL, 0, NULL);
// Flush image section if there is one.
if (FcbPtr->SectionObjectPointers.ImageSectionObject)
{
MmFlushImageSection(&FcbPtr->SectionObjectPointers, MmFlushForWrite);
}
// Purge cache section if there is one.
if (FcbPtr->SectionObjectPointers.DataSectionObject)
{
CcPurgeCacheSection(&FcbPtr->SectionObjectPointers, NULL, 0, FALSE);
}
----- Original Message -----
From:
To: “File Systems Developers”
Sent: Friday, March 07, 2003 11:38 AM
Subject: [ntfsd] More on IoCancelFileOpen
>
> Does anyone know a way of getting the cache manager to dereference a file
> object quickly before a call to IoCancelFileOpen?
>
> Our filter driver is intercepting creates - passing the irp down to the
> file system - and synchronising back to the original context via the
> completion routine. It then uses the resulting file object to do read
> operations. On the basis of those operations we may decide to cancel the
> create request and we do this via IoCancelFileOpen.
> At this point there are usually 3 outstanding references (I assume 2 are
> cache manager and 1 is iomanger) on the file object. Calling
> CcPurgeCacheSection causes the cache manager to dereference the file
> object, but there seems to be quite a delay - of at least one second
> between the call to CcPurgeCacheSection and the references actually
> disappearing.
>
> Is there a better way of getting the cache manager to drop the references?
>
> Thanks
>
> –
> Steven Braggs, Software Engineer, Sophos Anti-Virus
> Email: xxxxx@sophos.com, Tel: 01235 559933, Web: www.sophos.com
> Add live virus info to your website: http://www.sophos.com/link/vfeed
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
—
You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
To unsubscribe send a blank email to xxxxx@lists.osr.com
This piece of code is working for me, so I never tried to make it another
way.
----- Original Message -----
From: “Ampsi”
To: “File Systems Developers”
Sent: Thursday, March 13, 2003 4:03 AM
Subject: [ntfsd] Re: More on IoCancelFileOpen
> if i call CcFlushCache, then CcPurgeCacheSection followed by
> CcUninitializeCacheMap, without MmFlushImageSection, will the effect be
> drastically different?
>
> btw, is MmFlushImageSection necessary if CcFlushCache is called? i thought
> the image section is part of the cache?
>
> Ampsi
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “File Systems Developers”
> Sent: Thursday, March 13, 2003 01:26
> Subject: [ntfsd] Re: More on IoCancelFileOpen
>
>
> // Uninitialize FO caching.
>
> CcUninitializeCacheMap(FileObjectPtr, NULL, NULL);
>
> // Flush cache.
>
> CcFlushCache(&FcbPtr->SectionObjectPointers, NULL, 0, NULL);
>
> // Flush image section if there is one.
>
> if (FcbPtr->SectionObjectPointers.ImageSectionObject)
> {
> MmFlushImageSection(&FcbPtr->SectionObjectPointers, MmFlushForWrite);
> }
>
> // Purge cache section if there is one.
>
> if (FcbPtr->SectionObjectPointers.DataSectionObject)
> {
> CcPurgeCacheSection(&FcbPtr->SectionObjectPointers, NULL, 0, FALSE);
> }
>
>
>
> ----- Original Message -----
> From:
> To: “File Systems Developers”
> Sent: Friday, March 07, 2003 11:38 AM
> Subject: [ntfsd] More on IoCancelFileOpen
>
>
> >
> > Does anyone know a way of getting the cache manager to dereference a
file
> > object quickly before a call to IoCancelFileOpen?
> >
> > Our filter driver is intercepting creates - passing the irp down to the
> > file system - and synchronising back to the original context via the
> > completion routine. It then uses the resulting file object to do read
> > operations. On the basis of those operations we may decide to cancel
the
> > create request and we do this via IoCancelFileOpen.
> > At this point there are usually 3 outstanding references (I assume 2 are
> > cache manager and 1 is iomanger) on the file object. Calling
> > CcPurgeCacheSection causes the cache manager to dereference the file
> > object, but there seems to be quite a delay - of at least one second
> > between the call to CcPurgeCacheSection and the references actually
> > disappearing.
> >
> > Is there a better way of getting the cache manager to drop the
references?
> >
> > Thanks
> >
> > –
> > Steven Braggs, Software Engineer, Sophos Anti-Virus
> > Email: xxxxx@sophos.com, Tel: 01235 559933, Web: www.sophos.com
> > Add live virus info to your website: http://www.sophos.com/link/vfeed
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@pmail.ntu.edu.sg
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>