I have created one file in user mode and created few entries in it. I also
opened this file from my driver. Now i am reading this file from my driver
and appending this file from usermode. In user mode the process is diffrent
from kernel mode. In kernel i am reading the file from a thread created
using PsCreateSystemThread. The file is opened in user mode with no
intermediate buffering so that even if machine crashed, the data would be
safe. In the driver we are opening the file without no intermediate flag it
means with caching enabled. The Question is will we get the right data when
we read from kernel mode? I am asking this question because of diffrent
process are simultaneously reading and writing from same file.
what happen if we opened the file with buffering on ? I believe that there
would not be any problem because the data written by usermode is in cache,
and when we try to read data from kernel mode, cache manager will give us
the latest data.
–
Regards
Rohit Gauba
“A positive thought is the seed of a positive result”
Hi Rohit,
See comments below:
The file is opened in user
mode with no intermediate buffering so that even if machine
crashed, the data would be safe.
The file system is still allowed cache data using that file object.
However, I am not sure whether the FSD will flush the data in the write through manner so that the data is present in cache AND has been committed to the disk too.
If you want to be absolutely sure that the data gets written to the disk before the call returns use the write through flag.
In the driver we are
opening the file without no?intermediate flag it means with
caching enabled. The Question is will we get the right data
when we read from kernel mode? I am asking this question
because of diffrent process are simultaneously reading and
writing from same?file.
The FSD is responsible for providing a consistent view of the file for both cached and non cached access.
Regards,
Ayush Gupta
http://windows-internals.blogspot.com/
Cricket on your mind? Visit the ultimate cricket website. Enter http://beta.cricket.yahoo.com
@Rohit
>The file is opened in user mode with no intermediate buffering so that even if machine crashed, the data would be safe.
What sort of scenario is this, if machine crashed, any ways cache will be flushed, so what sort of safety are you think you are getting here?
>I believe that there would not be any problem because the data written by usermode is in cache, and when we try to read data from kernel mode, cache manager will give us the latest data.
you are contradicting yourself, you said in your post that, you have specified no intermediate buffering from i.e. FSD should not cache your file and here you are saying that data written by UM is in cache. ???
So how about telling the most important question. What are you trying to achieve here?
Aditya
> What sort of scenario is this, if machine crashed, any ways
cache will be flushed, so what sort of safety are you think
you are getting here?
I don’t think that the cache will be flushed incase the system CRASHES.
That is one drawback of the principle of caching and it is not specific to Windows: If the system crashes, and there is data in the cache, the data is lost! 
And the reason being that the Cache manager will not even be given the chance to flush the data. Generally the last flushing happens when the volume is dismounted. And in case of a crash, that wont happen.
Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush
Now surf faster and smarter ! Check out the new Firefox 3 - Yahoo! Edition http://downloads.yahoo.com/in/firefox/?fr=om_email_firefox
> That is one drawback of the principle of caching and it is
not specific to Windows: If the system crashes, and there is
data in the cache, the data is lost!
To be more precise, the uncommitted (unflushed) data in the cache will be lost.
Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush
Now surf faster and smarter ! Check out the new Firefox 3 - Yahoo! Edition http://downloads.yahoo.com/in/firefox/?fr=om_email_firefox
Thanks for ur reply.
Actually I am not aware that if machine crashed then the cache will be
flushed. I have read somewhere that if machine crash happen, then you should
blame cache manager if data on some file on disk is not consistent and that
file is recently written
Regarding contradicting myself i think you have not read the full question.
Question is “what happen if we opened the file with buffering on ? I believe
that there would not be any problem because the data written by usermode is
in cache, and when we try to read data from kernel mode, cache manager will
give us the latest data.”
Regards
Rohit Gauba
On Wed, May 13, 2009 at 4:02 PM, wrote:
> @Rohit
>
> >>The file is opened in user mode with no intermediate buffering so that
> even if machine crashed, the data would be safe.
>
> What sort of scenario is this, if machine crashed, any ways cache will be
> flushed, so what sort of safety are you think you are getting here?
>
> >>I believe that there would not be any problem because the data written by
> usermode is in cache, and when we try to read data from kernel mode, cache
> manager will give us the latest data.
>
> you are contradicting yourself, you said in your post that, you have
> specified no intermediate buffering from i.e. FSD should not cache your file
> and here you are saying that data written by UM is in cache. ???
>
> So how about telling the most important question. What are you trying to
> achieve here?
>
> Aditya
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
Regards
Rohit Gauba
“A positive thought is the seed of a positive result”
>>I don’t think that the cache will be flushed incase the system CRASHES.
I used wrong word ;-), read this line as cached data will be lost (not flushed) so what security is achieved. I mean even if the write was cached and cache manager has data, in case of system cache that will be lost, so what sort of security is achieved during system crash?
> >>I don’t think that the cache
will be flushed incase the system CRASHES.
I used wrong word ;-), read this line as cached data will
be lost (not flushed) so what security is achieved. I mean
even if the write was cached and cache manager has data, in
case of system cache that will be lost, so what sort of
security is achieved during system crash?
And hence, the better way would be to also use the write through flag. This will ensure that the data that is in the cache is also flushed to the disk synchronously and NOT by the lazy writer. BUT!!! This will affect the performance because of obvious reasons!
Regards,
Ayush Gupta
http://www.linkedin.com/in/guptaayush
Now surf faster and smarter ! Check out the new Firefox 3 - Yahoo! Edition http://downloads.yahoo.com/in/firefox/?fr=om_email_firefox
@Rohit,
>Actually I am not aware that if machine crashed then the cache will be flushed. I have read somewhere that if machine crash happen, then you should blame cache manager if data on some file on disk is not consistent and that file is recently written
that was my typo(read lost not flushed), you read it correct, your use of word “safe” somehow give me an impression related to security applications that you are worried about some one accessing the data in cache after the crash and is able to get hold of the actual data.
Performing non-cached data will not protects you from system crash, I mean you can have crashes after your write but before the port driver writes data to hardware. So there is no such warranty made. you do not need to worry abt this, provided that its not driver which is crashing. 
>Regarding contradicting myself i think you have not read the full question.
true, I blasted your post, my apologies, though some formatting would surly help ;-).
yes CM will do the job for you, you just need to read it once the data is modified.
Aditya
*you do not need to worry abt this, provided that its not *your* driver which is crashing.