question

NTFSD
1

i have a file system filter driver that watches the
filesystem of a hard disk drive f:, for all non cached
irp_reads, the mdl data is decrypted. so drive f: has
encrypted file’s, when there read there decrypted and this
works fine for my purposes.

but i had problems with irp_write, and having it so that
files written to the f: drive are written encrypted so i
cheated and used filesystem watcher class (works fine for
what i want), and use it to
encrypt files when any file is changed on the f: drive the
file is encrypted and this works fine.

the problem is when the two parts are combined. if i copy a
file from c: to f:, the file is encrypted but when i open the
file on the f: drive the file is read encrypted because the
file is in the cache because of the encryption.

is there a way to fix this problem ? can i remove the file
from the cache? ? ? ?

2

CcPurgeCacheSection I think would clear that cache.

xxxxx@uow.edu.au wrote:

i have a file system filter driver that watches the
filesystem of a hard disk drive f:, for all non cached
irp_reads, the mdl data is decrypted. so drive f: has
encrypted file’s, when there read there decrypted and this
works fine for my purposes.

but i had problems with irp_write, and having it so that
files written to the f: drive are written encrypted so i
cheated and used filesystem watcher class (works fine for
what i want), and use it to
encrypt files when any file is changed on the f: drive the
file is encrypted and this works fine.

the problem is when the two parts are combined. if i copy a
file from c: to f:, the file is encrypted but when i open the
file on the f: drive the file is read encrypted because the
file is in the cache because of the encryption.

is there a way to fix this problem ? can i remove the file
from the cache? ? ? ?

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

filter irp_mj_write, change no data but setup completion
routine and in the routine call CcPurgeCacheSection() for the
file ?

4

There is the CcPurgeCacheSection api that does this, not sure whether you
want the same of not.

5

Are you sure that’s what you want? In the description of
CcPurgeCacheSection():

“If the data had been modified prior to the purge operation, the updates to
the data are lost.”

You have already been told by Tony Mason that the only guaranteed way to
flush a file from cache to disk is to dismount the volume.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@uow.edu.au
Sent: Thursday, September 29, 2005 8:19 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] question

filter irp_mj_write, change no data but setup completion
routine and in the routine call CcPurgeCacheSection() for the
file ?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

>filter irp_mj_write, change no data but setup completion

routine and in the routine call CcPurgeCacheSection() for the
file ?

what If the data had been modified prior to the purge operation, don’t you
think your logic is going to make the FS lose the changes?

Try dismounting the volume instead, I am note sure, but in some thread of
OSR, an expert mentioned about doing something like this.

7

Still learning here, but FastIO reads from cache right? Can data in the
cache not be decrypted from within fastIO reads? Instead of purging the
encrypted copy in the cache, why not decrypt the object in a fastio routine?

Ken Cross wrote:

Are you sure that’s what you want? In the description of
CcPurgeCacheSection():

“If the data had been modified prior to the purge operation, the updates to
the data are lost.”

You have already been told by Tony Mason that the only guaranteed way to
flush a file from cache to disk is to dismount the volume.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@uow.edu.au
Sent: Thursday, September 29, 2005 8:19 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] question

filter irp_mj_write, change no data but setup completion
routine and in the routine call CcPurgeCacheSection() for the
file ?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

8

> Still learning here, but FastIO reads from cache right? Can data in the

cache not be decrypted from within fastIO reads?

No, definitely not. The data in the cache must be already decrypted.
Otherwise memory mapped files will not work.

L.

9

>Still learning here, but FastIO reads from cache right? Can data in the

cache not be decrypted from within fastIO reads? Instead of purging the
encrypted copy in the cache, why not decrypt the object in a fastio
routine?

Matt I tried this out, it runs into problems with memory mapped files.

10

There are a whole host of ugly nasty issues here, but the simplest one
to explain would be “memory mapped files”.

Write an application program that opens a file, memory maps it, closes
the open file and continues using the memory mapping. Cc functions
won’t DO anything because there is no cache manager state. Not even a
file system can fix this particular issue - once the data is in virtual
memory, it is *there*. If you want to GUARANTEE it goes away, reboot.
Dismounting and remounting the volume breaks the association of the file
with the contents in memory, which is the only way of which *I* know
will work 100% of the time - although the old data contents remain in
memory until that memory is recycled (but generally that won’t be too
long). If you want something that works sometimes, go ahead and use
CcFlushCache/CcPurgeCache - but at my core I’m a file systems developer,
and the answer “this only corrupts your data once in a while” is NOT
acceptable to me.

Theoretically, if you rendezvous all the processors (or otherwise
prevent them from opening your file while you are working) you could
walk through the handle tables of each process on the system and when
you find a process with an open handle to a section backed by your file,
or to your file itself, you could close the handle or kill the process
(my guess is if you close a handle on a process you might as well kill
it in most cases). This would require very specific knowledge of the
system to implement, create a highly noticeable “burp” in system
behavior, and likely create rather nasty side-effects (try randomly
killing processes on your system sometime) including spontaneous
reboots. Sounds like a debugging nightmare to me - and at the point you
have a significant chance of causing a BSOD you might as well just
reboot anyway.

As is often the case, however, when the questioner does not like the
answer they merely re-ask the question, perhaps in hope that the next
answer they receive will be more palatable.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in Los
Angeles, CA October 24-27, 2005.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Thursday, September 29, 2005 8:28 AM
To: ntfsd redirect
Subject: RE: [ntfsd] question

Are you sure that’s what you want? In the description of
CcPurgeCacheSection():

“If the data had been modified prior to the purge operation, the updates
to
the data are lost.”

You have already been told by Tony Mason that the only guaranteed way to
flush a file from cache to disk is to dismount the volume.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@uow.edu.au
Sent: Thursday, September 29, 2005 8:19 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] question

filter irp_mj_write, change no data but setup completion
routine and in the routine call CcPurgeCacheSection() for the
file ?

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

11

>There are a whole host of ugly nasty issues here, but the simplest one

to explain would be “memory mapped files”.

tony,

I know the issues with memory mapped files, you have explained it before.
But as you say, *what* are the other issues, if you could kindly explain, I
want to know them also.

Thanks

Amitrajit