OSR Development Kit Questions

I am interested in the OSR Filter Driver Development Kit (FDDK) and File System Development Kit (FSDK) and had some questions regarding these toolkits:

* What languages can be used? I would assume C and possibly C++.
* Is it possible to have a file system driver or filter which uses these toolkits to talk to a user-mode process that is written in .NET?
* How can this be done and is there any performance impact over talking to a C++ user-mode app?
* My goal is to create a product that gives the illusion that data is replicated to different file servers in real time. Thus I need to be able to detect when files and directories change in order to keep the file servers synchronized but I also need to intercept I/O requests so that for example if an application is trying to read a file on one file server, I can check if the locally cached copy of a file is the most current, otherwise I can stream the file across the network. Would it be recommended that I utilize a file system driver or a filter for this purpose? The filter sounds more promising as it feels like I am extending the file system versus re-implementing it.
* Does the File System Development Kit allow I/O requests to be serviced by the native Windows File System Driver? In other words, could I implement only the file system level changes that I wanted to and allow the FSDK to default/delegate the other handling to the native Windows File System Driver?

The file system development kit is for developing your own file system,
not for accessing a windows file system. The filter kit is what you
want. OSR is excellent in explaining their kit, so I would contact them
at the corporate email address and give in detail what you want to do.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

xxxxx@globalscape.com” wrote in message
news:xxxxx@ntfsd:

> I am interested in the OSR Filter Driver Development Kit (FDDK) and File System Development Kit (FSDK) and had some questions regarding these toolkits:
>
> * What languages can be used? I would assume C and possibly C++.
> * Is it possible to have a file system driver or filter which uses these toolkits to talk to a user-mode process that is written in .NET?
> * How can this be done and is there any performance impact over talking to a C++ user-mode app?
> * My goal is to create a product that gives the illusion that data is replicated to different file servers in real time. Thus I need to be able to detect when files and directories change in order to keep the file servers synchronized but I also need to intercept I/O requests so that for example if an application is trying to read a file on one file server, I can check if the locally cached copy of a file is the most current, otherwise I can stream the file across the network. Would it be recommended that I utilize a file system driver or a filter for this purpose? The filter sounds more promising as it feels like I am extending the file system versus re-implementing it.
> * Does the File System Development Kit allow I/O requests to be serviced by the native Windows File System Driver? In other words, could I implement only the file system level changes that I wanted to and allow the FSDK to default/delegate the other handling to the native Windows File System Driver?

Thanks I will do that. Can anyone offer any advice though on kernel-user mode communication where the user-mode application is .NET or Java? Can this be done and what kind of performance impact is there?

How often do you need to communicate with the app? .NET has very little impact vs. C, I have no idea about Java.
But even in C, you cannot e.g. have a callback on EVERY file open, that’ll make the system unusable.

xxxxx@gmail.com wrote:

Thanks I will do that. Can anyone offer any advice though on kernel-user mode communication where the user-mode application is .NET or Java? Can this be done and what kind of performance impact is there?


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

I am trying to determine the best approach. I am faced with the following problem. If an application is trying to open a file to read from it, I need to intercept that I/O request somehow and then check if the locally cached copy of a file is the most current, otherwise I must stream the file across the network so that the application can read the latest version of the file. Can all this be accomplished at the kernel level? I was thinking that it would be easier to handle this type of checking using managed code via a callback. So essentially use the kernel mode driver to intercept the request and then hand it off to managed code but only do this for files in a specific set of directories on a volume. I do care about performance though, so I am trying to think of ways I can utilize locking like oplocks to more quickly determine if a file is fully cached than having to check over the network. From what I understand though, oplocks can only by utilized on SMB/CIFS shares and so if I am making my own copies of the files and transmitting the file data via sockets then oplocks would not be supported under this scenario and I would have to enforce my own sort of locking, right?

You can do all of it from kernel mode. There is no reason user mode managed code would be any easier for data comparison, and callbacks would definitely cause performance issues. Opens are extremely common (in many situations, they are the most common I/O call).
I don’t know whether oplocks would work for you, it depends what type of remote storage the files can reside on.

xxxxx@gmail.com wrote:

I am trying to determine the best approach. I am faced with the following problem. If an application is trying to open a file to read from it, I need to intercept that I/O request somehow and then check if the locally cached copy of a file is the most current, otherwise I must stream the file across the network so that the application can read the latest version of the file. Can all this be accomplished at the kernel level? I was thinking that it would be easier to handle this type of checking using managed code via a callback. So essentially use the kernel mode driver to intercept the request and then hand it off to managed code but only do this for files in a specific set of directories on a volume. I do care about performance though, so I am trying to think of ways I can utilize locking like oplocks to more quickly determine if a file is fully cached than having to check over the network. From what I understand though, oplocks can only by utilized on SMB/CIFS shares and so
if I am making my own copies of the files and transmitting the file data via sockets then oplocks would not be supported under this scenario and I would have to enforce my own sort of locking, right?


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

OK, thanks. So you would say even trying the Shared Memory IOCTL approach to communicating from kernel to user mode and back for file opens should be discouraged due to the performance impact?

Compared to kernel only approach, you are adding the IOCTL. That is not a cheap operation to add to each file open.
If you use simple C in user mode, then there is no reason you can’t do it in the kernel.
If you use more complex code, you are likely adding some additional overhead, so there’s a reason to do it in the kernel instead.
There is an added bonus in doing it in kernel mode - you don’t have to waste time on IOCTL programming for that sort of processing :wink: It’s quite a boring, tedious and time consuming part
really.

xxxxx@gmail.com wrote:

OK, thanks. So you would say even trying the Shared Memory IOCTL approach to communicating from kernel to user mode and back for file opens should be discouraged due to the performance impact?


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

I’d be happy to answer any technical questions about our kits off list. Please feel free to send me an e-mail.

Tony
OSR

The model for what you want is what I have referred to as an “isolation filter” - a specific type of filter that can be used for fulfilling application requests from a variety of sources in a fashion that is transparent to the application. See http://www.osronline.com/article.cfm?article=560 for the first article in the series.

Tony
OSR