Problem with FltQueueDeferredIoWorkItem()

NTFSD
1

Hi all

Since it seems that I cannot post a message in the ntfsd forum on
osronline.com (even after registration) I will submit my problem in this
mail.

I’m working on a project that needs to do a real time image of an ntfs
volume.

For this when the backup process is started I need to “filter” the writes on
the volume and retrieve the data from the location where the write operation
will operate and then allowing for the write to continue because I want to
have consistent data in the final image.

I did write a driver that uses the Filter Manager in order to do this and
registered for the IRP_MJ_WRITE a PreWriteCallback.

Since I want to postpone (pend) the write operation from what I have read
from the IFS DDK documentation the sequence of operations is the following :

  1. Allocate a work item with FltAllocateDeferredWorkItem in the
    PreWriteCallback
  2. Queue the Item to a WorkRoutine using FltQueueDeferredWorkItem in the
    PreWriteCallback
  3. Return in the PreWriteCallback FLT_PREOP_PENDING
  4. In the worker routine after I do the operations needed I call
    FltCompletePendedPreOperation and setting the CallBack status to
    FLT_PREOP_SUCCESS_NO_CALLBACK

Well the problem is that almost all my calls to FltAllocateDeferredWorkItem
seem to fail because it returns STATUS_NOT_SAFE_TO_POST_OPERATION and I
cannot post
to the worker routine.
From what I have read this is happening because IoGetTopLevelIrp does not
return NULL.

The question is how can I process this writes in a worker routine after
pending them in the PreWriteCallback ? Is this possible ? I want to do the
processing in a worker routine because sometimes I need to wait on a kernel
event before proceeding.

Is my approach for the problem wrong and there is another solution ?

P.S.1 : Before trying to do the above operations in the PreWriteCallback i’m
checking if it is an Irp-based I/O operation using FLT_IS_OPERATION_DATA
P.S.2 : Another strange problem is that everytime I check in the
PreWriteCallback the Data->Iopb->Parameters.Write.Length it seems to be 0 !

2

Instead of whining THE FIRST DAY YOU’RE A MEMBER OF THE LIST, you might wanna read the ListServer/Forum page, where it says HIGHLIGHTED IN YELLOW:

Please Note: Posting (of both replies and new threads) via this new interface has not yet been enabled, so we can start this new feature up slowly. We expect the posting interface to be enabled “soon”.

Good way to start your tenure as an NTFSD member. Welcome aboard,

Peter
OSR

3

Victor,

Possible reasons for status STATUS_NOT_SAFE_TO_POST_OPERATION are:

  1. TopLevelIrp field of the current thread is NOT NULL: If the current
    thread holds resources above the file system, you should not try to perform
    these operations in another thread, as you can deadlock trying to grab the
    same resources now from the worker thread.

  2. This is a paging I/O operation: It is not safe to pend paging I/O.
    If you pend paging I/O at IRQL=APC, the required special Kernel APC to
    complete the I/O can not be processed and this will cause deadlock.

You should verify which your case is.

Paging I/O writes are for the following operations:

  1. Page write to pagefile.

  2. Page write to mapped file.

  3. Cache flush by Lazy writer / CcFlushCache

Are you sure you need to filter this type of Non-cached I/O in PreWrite
callback?.

By the way, in step 4 you should call FltFreeDeferredIoWorkItem to free the
work item.

Regards,

Ramon Royo

De: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] En nombre de Victor Asavei
Enviado el: mi?rcoles, 29 de marzo de 2006 1:33
Para: Windows File Systems Devs Interest List
Asunto: [ntfsd] Problem with FltQueueDeferredIoWorkItem()

Hi all

Since it seems that I cannot post a message in the ntfsd forum on
osronline.com (even after registration) I will submit my problem in this
mail.

I’m working on a project that needs to do a real time image of an ntfs
volume.

For this when the backup process is started I need to “filter” the writes on
the volume and retrieve the data from the location where the write operation
will operate and then allowing for the write to continue because I want to
have consistent data in the final image.

I did write a driver that uses the Filter Manager in order to do this and
registered for the IRP_MJ_WRITE a PreWriteCallback.

Since I want to postpone (pend) the write operation from what I have read
from the IFS DDK documentation the sequence of operations is the following :

  1. Allocate a work item with FltAllocateDeferredWorkItem in the
    PreWriteCallback
  2. Queue the Item to a WorkRoutine using FltQueueDeferredWorkItem in the
    PreWriteCallback
  3. Return in the PreWriteCallback FLT_PREOP_PENDING
  4. In the worker routine after I do the operations needed I call
    FltCompletePendedPreOperation and setting the CallBack status to
    FLT_PREOP_SUCCESS_NO_CALLBACK

Well the problem is that almost all my calls to FltAllocateDeferredWorkItem
seem to fail because it returns STATUS_NOT_SAFE_TO_POST_OPERATION and I
cannot post
to the worker routine.
From what I have read this is happening because IoGetTopLevelIrp does not
return NULL.

The question is how can I process this writes in a worker routine after
pending them in the PreWriteCallback ? Is this possible ? I want to do the
processing in a worker routine because sometimes I need to wait on a kernel
event before proceeding.

Is my approach for the problem wrong and there is another solution ?

P.S.1 : Before trying to do the above operations in the PreWriteCallback i’m
checking if it is an Irp-based I/O operation using FLT_IS_OPERATION_DATA
P.S.2 : Another strange problem is that everytime I check in the
PreWriteCallback the Data->Iopb->Parameters.Write.Length it seems to be 0 !

— Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17 You are currently subscribed to
ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank email
to xxxxx@lists.osr.com

4

Sorry, my fault.
I thought that I saw somewhere that the interface should be functional after
January 2006. I was not whining and I did mention that because I hoped that
someone will point out where I was wrong…thank you for doing that.
On 3/29/06, xxxxx@osr.com wrote:
>
>


>
> Instead of whining THE FIRST DAY YOU’RE A MEMBER OF THE LIST, you might
> wanna read the ListServer/Forum page, where it says HIGHLIGHTED IN YELLOW:
>
> Please Note: Posting (of both replies and new threads) via this new
> interface has not yet been enabled, so we can start this new feature up
> slowly. We expect the posting interface to be enabled “soon”.
>
> Good way to start your tenure as an NTFSD member. Welcome aboard,

Thanks for your kind words.

Peter
> OSR
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

On 3/29/06, Ram?n Royo wrote:
>
> Victor,
>
>
>
> Possible reasons for status STATUS_NOT_SAFE_TO_POST_OPERATION are:
>
>
>
> 1) TopLevelIrp field of the current thread is NOT NULL: If the
> current thread holds resources above the file system, you should not try to
> perform these operations in another thread, as you can deadlock trying to
> grab the same resources now from the worker thread.
>
2) This is a paging I/O operation: It is not safe to pend paging I/O.
If you pend paging I/O at IRQL=APC, the required special Kernel APC to
complete the I/O can not be processed and this will cause deadlock.
>
>
>
> You should verify which your case is.
>

Yes, this is what is also mentioned in the IFS DDK documentation (and I
think it’s both the above cases in the program). From what I have seen I can
process only writes on a few LCN’s at the beginning of the volume and that’s
not good. Is there no other way to process the writes (by processing I mean
reading first the location where they want to write) ? I don’t think I can
do this from the PreWriteCallback because I read the data communicating
directly with the underneath driver to which I am attached and doing this
synchronously.

Paging I/O writes are for the following operations:
>
>
>
> 1) Page write to pagefile.
>
> 2) Page write to mapped file.
>
> 3) Cache flush by Lazy writer / CcFlushCache
>
>
>
> Are you sure you need to filter this type of Non-cached I/O in PreWrite
> callback?.
>

I need to filter only the I/O that actually is writing on the volume.

By the way, in step 4 you should call FltFreeDeferredIoWorkItem to free the
> work item.
>

Yes…I do that.

Regards,
>
> Ramon Royo
> ------------------------------
>
> De: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *En nombre de *Victor Asavei
> Enviado el: mi?rcoles, 29 de marzo de 2006 1:33
> Para: Windows File Systems Devs Interest List
> Asunto: [ntfsd] Problem with FltQueueDeferredIoWorkItem()
>
>
>
> Hi all
>
> Since it seems that I cannot post a message in the ntfsd forum on
> osronline.com (even after registration) I will submit my problem in this
> mail.
>
> I’m working on a project that needs to do a real time image of an ntfs
> volume.
>
> For this when the backup process is started I need to “filter” the writes
> on the volume and retrieve the data from the location where the write
> operation will operate and then allowing for the write to continue because I
> want to have consistent data in the final image.
>
> I did write a driver that uses the Filter Manager in order to do this and
> registered for the IRP_MJ_WRITE a PreWriteCallback.
>
> Since I want to postpone (pend) the write operation from what I have read
> from the IFS DDK documentation the sequence of operations is the following :
>
> 1. Allocate a work item with FltAllocateDeferredWorkItem in the
> PreWriteCallback
> 2. Queue the Item to a WorkRoutine using FltQueueDeferredWorkItem in the
> PreWriteCallback
> 3. Return in the PreWriteCallback FLT_PREOP_PENDING
> 4. In the worker routine after I do the operations needed I call
> FltCompletePendedPreOperation and setting the CallBack status to
> FLT_PREOP_SUCCESS_NO_CALLBACK
>
> Well the problem is that almost all my calls to
> FltAllocateDeferredWorkItem seem to fail because it returns
> STATUS_NOT_SAFE_TO_POST_OPERATION and I cannot post
> to the worker routine.
> From what I have read this is happening because IoGetTopLevelIrp does not
> return NULL.
>
> The question is how can I process this writes in a worker routine after
> pending them in the PreWriteCallback ? Is this possible ? I want to do the
> processing in a worker routine because sometimes I need to wait on a kernel
> event before proceeding.
>
> Is my approach for the problem wrong and there is another solution ?
>
> P.S.1 : Before trying to do the above operations in the PreWriteCallback
> i’m checking if it is an Irp-based I/O operation using FLT_IS_OPERATION_DATA
>
> P.S.2 : Another strange problem is that everytime I check in the
> PreWriteCallback the Data->Iopb->Parameters.Write.Length it seems to be 0
> !
>
> — Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17 You are currently subscribed
> to ntfsd as: unknown lmsubst tag argument: ‘’ To unsubscribe send a blank
> email to xxxxx@lists.osr.com
>
>
> —
>
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>