NAV 2004 Problems

NTFSD
1

Hi All,

Just a quick query really. Is anyone else experiencing problems with
their filter when used in combination with Norton Anti-Virus 2004?

As part of my IRP_MJ_CREATE dispatch handler I check for the existence
of a certain file and if found read it, I then continue on my merry way
and process the original create request.

Now all is fine until I install NAV 2004 which seems to insist on
consuming huge gobs of kernel stack space! So much in fact that I am
suprised the operating system doesn`t bugcheck with just their driver
installed!!

I now about the “If it works without your filter then it is your bug”
thing and on the whole I agree with it, but if I am already installed
and working fine and then one of our customers installs NAV 2004 and it
all breaks then that would imply that the NAV driver is at fault…

Great, but you try explaining why our little company is right and Symantec
are wrong :frowning:

Anyway, rant out the way, does anyone have any useful suggestions as to
ways to combat this problem. I have profiled my driver and compared with
Symantec my driver only uses a fraction of the stack they use!

Any thoughts or solutions would be most appreciated.

Regards

Ben Curley
Software Engineer
Data Encryption Systems Ltd.

Tel: +44 (0)1823 352357 (Main)
Tel: +44 (0)1823 358320 (Direct Dial)

Web: http://www.deslock.com

2

Worker threads.

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
Sent: Friday, October 03, 2003 1:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] NAV 2004 Problems

Hi All,

Just a quick query really. Is anyone else experiencing problems with
their filter when used in combination with Norton Anti-Virus 2004?

As part of my IRP_MJ_CREATE dispatch handler I check for the existence
of a certain file and if found read it, I then continue on my merry way
and process the original create request.

Now all is fine until I install NAV 2004 which seems to insist on
consuming huge gobs of kernel stack space! So much in fact that I am
suprised the operating system doesn`t bugcheck with just their driver
installed!!

I now about the “If it works without your filter then it is your bug”
thing and on the whole I agree with it, but if I am already installed
and working fine and then one of our customers installs NAV 2004 and it
all breaks then that would imply that the NAV driver is at fault…

Great, but you try explaining why our little company is right and
Symantec
are wrong :frowning:

Anyway, rant out the way, does anyone have any useful suggestions as to
ways to combat this problem. I have profiled my driver and compared with
Symantec my driver only uses a fraction of the stack they use!

Any thoughts or solutions would be most appreciated.

Regards

Ben Curley
Software Engineer
Data Encryption Systems Ltd.

Tel: +44 (0)1823 352357 (Main)
Tel: +44 (0)1823 358320 (Direct Dial)

Web: http://www.deslock.com

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Yeah, but is it a good idea to do this in the create path? I thought
pending creates was living dangerously…

Matt

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Friday, October 03, 2003 3:43 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: NAV 2004 Problems

Worker threads.

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
Sent: Friday, October 03, 2003 1:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] NAV 2004 Problems

Hi All,

Just a quick query really. Is anyone else experiencing problems with
their filter when used in combination with Norton Anti-Virus 2004?

As part of my IRP_MJ_CREATE dispatch handler I check for the existence
of a certain file and if found read it, I then continue on my merry way
and process the original create request.

Now all is fine until I install NAV 2004 which seems to insist on
consuming huge gobs of kernel stack space! So much in fact that I am
suprised the operating system doesn`t bugcheck with just their driver
installed!!

I now about the “If it works without your filter then it is your bug”
thing and on the whole I agree with it, but if I am already installed
and working fine and then one of our customers installs NAV 2004 and it
all breaks then that would imply that the NAV driver is at fault…

Great, but you try explaining why our little company is right and
Symantec are wrong :frowning:

Anyway, rant out the way, does anyone have any useful suggestions as to
ways to combat this problem. I have profiled my driver and compared with
Symantec my driver only uses a fraction of the stack they use!

Any thoughts or solutions would be most appreciated.

Regards

Ben Curley
Software Engineer
Data Encryption Systems Ltd.

Tel: +44 (0)1823 352357 (Main)
Tel: +44 (0)1823 358320 (Direct Dial)

Web: http://www.deslock.com

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Have the original thread wait for the worker thread to
finish, then complete or pass down the irp in the
orginal thread.

Randy

— “Matthew N. White” wrote:
> Yeah, but is it a good idea to do this in the create
> path? I thought
> pending creates was living dangerously…
>
> Matt
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Peter Scott
> Sent: Friday, October 03, 2003 3:43 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] RE: NAV 2004 Problems
>
>
>
> Worker threads.
>
> Peter Scott
> xxxxx@KernelDrivers.com
> www.KernelDrivers.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of xxxxx@des.co.uk
> Sent: Friday, October 03, 2003 1:12 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] NAV 2004 Problems
>
>
> Hi All,
>
> Just a quick query really. Is anyone else
> experiencing problems with
> their filter when used in combination with Norton
> Anti-Virus 2004?
>
> As part of my IRP_MJ_CREATE dispatch handler I check
> for the existence
> of a certain file and if found read it, I then
> continue on my merry way
> and process the original create request.
>
> Now all is fine until I install NAV 2004 which seems
> to insist on
> consuming huge gobs of kernel stack space! So much
> in fact that I am
> suprised the operating system doesn`t bugcheck with
> just their driver
> installed!!
>
> I now about the “If it works without your filter
> then it is your bug”
> thing and on the whole I agree with it, but if I am
> already installed
> and working fine and then one of our customers
> installs NAV 2004 and it
> all breaks then that would imply that the NAV driver
> is at fault…
>
> Great, but you try explaining why our little company
> is right and
> Symantec are wrong :frowning:
>
> Anyway, rant out the way, does anyone have any
> useful suggestions as to
> ways to combat this problem. I have profiled my
> driver and compared with
> Symantec my driver only uses a fraction of the stack
> they use!
>
> Any thoughts or solutions would be most appreciated.
>
> Regards
>
> Ben Curley
> Software Engineer
> Data Encryption Systems Ltd.
>
> Tel: +44 (0)1823 352357 (Main)
> Tel: +44 (0)1823 358320 (Direct Dial)
>
> Web: http://www.deslock.com
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@kerneldrivers.com To
> unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@bitarmor.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com

5

There is nothing wrong with pending creates. However, I can think of two
major AV products and one open-file manager that do not correctly handle
STATUS_PENDING on the create path. Technically, it is a bug in their
filter, but I doubt your customers will see it that way.

Also, beware re-entering the FS with a create of your own in a worker thread
(and blocking in the original thread). DFS likes to hold locks across
system calls and will deadlock your system.

----- Original Message -----
From: “Matthew N. White”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, October 04, 2003 4:12 PM
Subject: [ntfsd] RE: NAV 2004 Problems

> Yeah, but is it a good idea to do this in the create path? I thought
> pending creates was living dangerously…
>
> Matt
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
> Sent: Friday, October 03, 2003 3:43 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] RE: NAV 2004 Problems
>
>
>
> Worker threads.
>
> Peter Scott
> xxxxx@KernelDrivers.com
> www.KernelDrivers.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
> Sent: Friday, October 03, 2003 1:12 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] NAV 2004 Problems
>
>
> Hi All,
>
> Just a quick query really. Is anyone else experiencing problems with
> their filter when used in combination with Norton Anti-Virus 2004?
>
> As part of my IRP_MJ_CREATE dispatch handler I check for the existence
> of a certain file and if found read it, I then continue on my merry way
> and process the original create request.
>
> Now all is fine until I install NAV 2004 which seems to insist on
> consuming huge gobs of kernel stack space! So much in fact that I am
> suprised the operating system doesn`t bugcheck with just their driver
> installed!!
>
> I now about the “If it works without your filter then it is your bug”
> thing and on the whole I agree with it, but if I am already installed
> and working fine and then one of our customers installs NAV 2004 and it
> all breaks then that would imply that the NAV driver is at fault…
>
> Great, but you try explaining why our little company is right and
> Symantec are wrong :frowning:
>
> Anyway, rant out the way, does anyone have any useful suggestions as to
> ways to combat this problem. I have profiled my driver and compared with
> Symantec my driver only uses a fraction of the stack they use!
>
> Any thoughts or solutions would be most appreciated.
>
> Regards
>
> Ben Curley
> Software Engineer
> Data Encryption Systems Ltd.
>
> Tel: +44 (0)1823 352357 (Main)
> Tel: +44 (0)1823 358320 (Direct Dial)
>
> Web: http://www.deslock.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@bitarmor.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Don’t pend the create, just block on some event that is set by the
worker when it is complete. Beware of re-entrancy though; get around
this by either the shadow device technique or keeping track of your
worker thread ID.

Pete

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Matthew N. White
Sent: Saturday, October 04, 2003 3:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: NAV 2004 Problems

Yeah, but is it a good idea to do this in the create path? I thought
pending creates was living dangerously…

Matt

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Friday, October 03, 2003 3:43 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: NAV 2004 Problems

Worker threads.

Peter Scott
xxxxx@KernelDrivers.com
www.KernelDrivers.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
Sent: Friday, October 03, 2003 1:12 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] NAV 2004 Problems

Hi All,

Just a quick query really. Is anyone else experiencing problems with
their filter when used in combination with Norton Anti-Virus 2004?

As part of my IRP_MJ_CREATE dispatch handler I check for the existence
of a certain file and if found read it, I then continue on my merry way
and process the original create request.

Now all is fine until I install NAV 2004 which seems to insist on
consuming huge gobs of kernel stack space! So much in fact that I am
suprised the operating system doesn`t bugcheck with just their driver
installed!!

I now about the “If it works without your filter then it is your bug”
thing and on the whole I agree with it, but if I am already installed
and working fine and then one of our customers installs NAV 2004 and it
all breaks then that would imply that the NAV driver is at fault…

Great, but you try explaining why our little company is right and
Symantec are wrong :frowning:

Anyway, rant out the way, does anyone have any useful suggestions as to
ways to combat this problem. I have profiled my driver and compared with
Symantec my driver only uses a fraction of the stack they use!

Any thoughts or solutions would be most appreciated.

Regards

Ben Curley
Software Engineer
Data Encryption Systems Ltd.

Tel: +44 (0)1823 352357 (Main)
Tel: +44 (0)1823 358320 (Direct Dial)

Web: http://www.deslock.com

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@bitarmor.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Which open-file manager would this be?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Drivers R Us
Sent: Sunday, October 05, 2003 5:50 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: NAV 2004 Problems

There is nothing wrong with pending creates. However, I can think of
two
major AV products and one open-file manager that do not correctly handle
STATUS_PENDING on the create path. Technically, it is a bug in their
filter, but I doubt your customers will see it that way.

Also, beware re-entering the FS with a create of your own in a worker
thread
(and blocking in the original thread). DFS likes to hold locks across
system calls and will deadlock your system.

----- Original Message -----
From: “Matthew N. White”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, October 04, 2003 4:12 PM
Subject: [ntfsd] RE: NAV 2004 Problems

> Yeah, but is it a good idea to do this in the create path? I thought
> pending creates was living dangerously…
>
> Matt
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
> Sent: Friday, October 03, 2003 3:43 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] RE: NAV 2004 Problems
>
>
>
> Worker threads.
>
> Peter Scott
> xxxxx@KernelDrivers.com
> www.KernelDrivers.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
> Sent: Friday, October 03, 2003 1:12 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] NAV 2004 Problems
>
>
> Hi All,
>
> Just a quick query really. Is anyone else experiencing problems with
> their filter when used in combination with Norton Anti-Virus 2004?
>
> As part of my IRP_MJ_CREATE dispatch handler I check for the existence
> of a certain file and if found read it, I then continue on my merry
way
> and process the original create request.
>
> Now all is fine until I install NAV 2004 which seems to insist on
> consuming huge gobs of kernel stack space! So much in fact that I am
> suprised the operating system doesn`t bugcheck with just their driver
> installed!!
>
> I now about the “If it works without your filter then it is your bug”
> thing and on the whole I agree with it, but if I am already installed
> and working fine and then one of our customers installs NAV 2004 and
it
> all breaks then that would imply that the NAV driver is at fault…
>
> Great, but you try explaining why our little company is right and
> Symantec are wrong :frowning:
>
> Anyway, rant out the way, does anyone have any useful suggestions as
to
> ways to combat this problem. I have profiled my driver and compared
with
> Symantec my driver only uses a fraction of the stack they use!
>
> Any thoughts or solutions would be most appreciated.
>
> Regards
>
> Ben Curley
> Software Engineer
> Data Encryption Systems Ltd.
>
> Tel: +44 (0)1823 352357 (Main)
> Tel: +44 (0)1823 358320 (Direct Dial)
>
> Web: http://www.deslock.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@bitarmor.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com

—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

What do you mean by: “do not correctly handle STATUS_PENDING”?

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Drivers R Us
Sent: Sunday, October 05, 2003 5:50 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] RE: NAV 2004 Problems

There is nothing wrong with pending creates. However, I can think of
two
major AV products and one open-file manager that do not correctly handle
STATUS_PENDING on the create path. Technically, it is a bug in their
filter, but I doubt your customers will see it that way.

Also, beware re-entering the FS with a create of your own in a worker
thread
(and blocking in the original thread). DFS likes to hold locks across
system calls and will deadlock your system.

----- Original Message -----
From: “Matthew N. White”
To: “Windows File Systems Devs Interest List”
Sent: Saturday, October 04, 2003 4:12 PM
Subject: [ntfsd] RE: NAV 2004 Problems

> Yeah, but is it a good idea to do this in the create path? I thought
> pending creates was living dangerously…
>
> Matt
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
> Sent: Friday, October 03, 2003 3:43 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] RE: NAV 2004 Problems
>
>
>
> Worker threads.
>
> Peter Scott
> xxxxx@KernelDrivers.com
> www.KernelDrivers.com
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@des.co.uk
> Sent: Friday, October 03, 2003 1:12 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] NAV 2004 Problems
>
>
> Hi All,
>
> Just a quick query really. Is anyone else experiencing problems with
> their filter when used in combination with Norton Anti-Virus 2004?
>
> As part of my IRP_MJ_CREATE dispatch handler I check for the existence
> of a certain file and if found read it, I then continue on my merry
way
> and process the original create request.
>
> Now all is fine until I install NAV 2004 which seems to insist on
> consuming huge gobs of kernel stack space! So much in fact that I am
> suprised the operating system doesn`t bugcheck with just their driver
> installed!!
>
> I now about the “If it works without your filter then it is your bug”
> thing and on the whole I agree with it, but if I am already installed
> and working fine and then one of our customers installs NAV 2004 and
it
> all breaks then that would imply that the NAV driver is at fault…
>
> Great, but you try explaining why our little company is right and
> Symantec are wrong :frowning:
>
> Anyway, rant out the way, does anyone have any useful suggestions as
to
> ways to combat this problem. I have profiled my driver and compared
with
> Symantec my driver only uses a fraction of the stack they use!
>
> Any thoughts or solutions would be most appreciated.
>
> Regards
>
> Ben Curley
> Software Engineer
> Data Encryption Systems Ltd.
>
> Tel: +44 (0)1823 352357 (Main)
> Tel: +44 (0)1823 358320 (Direct Dial)
>
> Web: http://www.deslock.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@bitarmor.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sbcglobal.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com

—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com