Hi all,
There are a lot of paging i/o with stream fileobject in my irp_mj_write dispatch, which is from ccflushcache used by system process, and i cann’t get the file name of the fileobject. I record the file name in irp_mj_create dispatch routine with fscontext, and when a write i/o request is recieved, i will search the filename list with fscontext, but i can not get the above fileobject’s filename, does it created without irp_mj_create? and there is no create request from user mode of the file before? Please help me!
Thank you
There is no IRP_MJ_CREATE send for stream file object. It is created
using IoCreateStreamFileObject(Ex). Stream FO are used to initialize cache
map on NTFS. On post-write or post-read you can get file object used by CM.
Use CcGetFileObjectFromSectionPtrs. If retrieved FO is not your original FO
and it was not already recorded, you must record it’s fscontext and some
additional data from the original FO, so when some other read/write
operation will be received with this stream FO you’ll have the information
about it.
Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]
|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-264119-
|xxxxx@lists.osr.com] On Behalf Of zymoonstone@163.com
|Sent: Thursday, September 28, 2006 4:34 PM
|To: Windows File Systems Devs Interest List
|Subject: [ntfsd] problem with stream fileobject
|
|Hi all,
| There are a lot of paging i/o with stream fileobject in my irp_mj_write
|dispatch, which is from ccflushcache used by system process, and i cann’t
|get the file name of the fileobject. I record the file name in
|irp_mj_create dispatch routine with fscontext, and when a write i/o request
|is recieved, i will search the filename list with fscontext, but i can not
|get the above fileobject’s filename, does it created without irp_mj_create?
|and there is no create request from user mode of the file before? Please
|help me!
|
|Thank you
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com
Hi,
This is a stream file object for internal FSD’s data.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Hi all,
> There are a lot of paging i/o with stream fileobject in my irp_mj_write
> dispatch, which is from ccflushcache used by system process, and i cann’t
> get the file name of the fileobject. I record the file name in
> irp_mj_create dispatch routine with fscontext, and when a write i/o
> request is recieved, i will search the filename list with fscontext, but i
> can not get the above fileobject’s filename, does it created without
> irp_mj_create? and there is no create request from user mode of the file
> before? Please help me!
>
> Thank you
>
CcGetFileObjectFromSectionPtrs returns unreferenced FO. Your filter driver
must gurantee that the returned FO has not been closed before you receive
the pointer.
–
Slava Imameyev, xxxxx@hotmail.com
“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> There is no IRP_MJ_CREATE send for stream file object. It is created
> using IoCreateStreamFileObject(Ex). Stream FO are used to initialize cache
> map on NTFS. On post-write or post-read you can get file object used by
> CM.
> Use CcGetFileObjectFromSectionPtrs. If retrieved FO is not your original
> FO
> and it was not already recorded, you must record it’s fscontext and some
> additional data from the original FO, so when some other read/write
> operation will be received with this stream FO you’ll have the information
> about it.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-264119-
> |xxxxx@lists.osr.com] On Behalf Of zymoonstone@163.com
> |Sent: Thursday, September 28, 2006 4:34 PM
> |To: Windows File Systems Devs Interest List
> |Subject: [ntfsd] problem with stream fileobject
> |
> |Hi all,
> | There are a lot of paging i/o with stream fileobject in my
> irp_mj_write
> |dispatch, which is from ccflushcache used by system process, and i cann’t
> |get the file name of the fileobject. I record the file name in
> |irp_mj_create dispatch routine with fscontext, and when a write i/o
> request
> |is recieved, i will search the filename list with fscontext, but i can
> not
> |get the above fileobject’s filename, does it created without
> irp_mj_create?
> |and there is no create request from user mode of the file before? Please
> |help me!
> |
> |Thank you
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
Thank you for your reply.
I do record the file information with fscontext in my irp_mj_create routine, so if the file is created by usermode before it’s used by CM, i could get the stream fileobject’s information. That means, the file has never been created by usermode before it’s used by CM?
>That means, the file has never been created by usermode before it’s used by
CM
Yes, FSDs create stream file objects to map their internal data( e.g.
allocation tables etc. ).
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Thank you for your reply.
> I do record the file information with fscontext in my irp_mj_create
> routine, so if the file is created by usermode before it’s used by CM, i
> could get the stream fileobject’s information. That means, the file has
> never been created by usermode before it’s used by CM?
>
>
>This is a stream file object for internal FSD’s data.
Are these datas useful, i mean, if i dont encrypt these datas, would the file be destroyed?
>Yes, FSDs create stream file objects to map their internal data
Than mean, i can ignore all these datas in my encrypt/decrypt filter?
>Are these datas useful,
Yes.
if i dont encrypt these datas, would the file be destroyed?
No.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> >This is a stream file object for internal FSD’s data.
> Are these datas useful, i mean, if i dont encrypt these datas, would the
> file be destroyed?
>
>
> Than mean, i can ignore all these datas in my encrypt/decrypt filter?
Yes, if this is a stream file object for internal data.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> >Yes, FSDs create stream file objects to map their internal data
> Than mean, i can ignore all these datas in my encrypt/decrypt filter?
>
Does the fileobject created by iocreatestreamfileobject(NULL,deviceobject)?
How to verity that these fileobject is for internal date?
>Does the fileobject created by iocreatestreamfileobject(NULL,deviceobject)?
Yes.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Does the fileobject created by
> iocreatestreamfileobject(NULL,deviceobject)?
>
>How to verity that these fileobject is for internal date?
This is not an easy task.
First read the article - http://www.osronline.com/article.cfm?id=102
In your case the simplest way is to skip all objects whose FsContext you
can’t find.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> How to verity that these fileobject is for internal date?
>
Stream FileObjects are typically internal streams that FS below you creates
and therefoew you don’t see IRP_MJ_CREATE for them. They share same
FsContext as the FileObject you see in IRP_MJ_CREATE dispatch. Of course,
not all stream file objects refers to user opened files, you have NTFS
metadata and also note that any filter can open a stream file object and use
it to write to a file. For these stream file obejcts, you will not have a
IRP_MJ_CREATE for a FileObject with the same FsContext. If you need to track
them, you need to cache file name information for them the first time that
that they are seen.
NTFS creates stream FileObjects to initialize the cache for a given file, so
in this case you will see paging i/o activity using this stream FileObject
instead of your IRP_MJ_CREATE FileObject.
Regards,
mK
Hi all,
There are a lot of paging i/o with stream fileobject in my irp_mj_write
dispatch, which is from ccflushcache used by system process, and i cann’t
get the file name of the fileobject. I record the file name in irp_mj_create
dispatch routine with fscontext, and when a write i/o request is recieved, i
will search the filename list with fscontext, but i can not get the above
fileobject’s filename, does it created without irp_mj_create? and there is
no create request from user mode of the file before? Please help me!
Thank you
Express yourself instantly with MSN Messenger! Download today it’s FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
> First read the article - http://www.osronline.com/article.cfm?id=102
yes, i have read this article several times, and it give me a lot of help, now, another question is, in
some case, the file information entry in the list can not be deleted, while another new file is
created with the fscontext, so i should decide whether to plus the count, or set the count to 1, is there a good solution?