questions on fileobjects, file_id etc.

Hi,

I am writing a filter driver and have a few questions:

  1. which fileobject is used by Mm for paging io. SOP has a pointer to
    the fileObject, but I want to know which fileObject would be used, if
    a file has several open instances.

  2. Is it possible that fileobjects are created outside of IRP_MJ_CREATE?
    If I want to track all the fileObjects in a system, is it enough
    to be only looking at IRP_MJ_CREATE?

  3. I want to deny opens of certain files in my filter driver. Is it
    good to be checking for FILE_ID’s? Checking on names has the very high
    overhead of converting a given path into a longpath. Do FILE_ID’s
    exist on every filesystem? Are file_id’s persistent across reboots?
    Can anyone think of caveats while using file_ids? Do hardlinks (on
    NTFS) have the same file_id?

Thanks

>1) which fileobject is used by Mm for paging io. SOP has a pointer to

the fileObject, but I want to know which fileObject would be used, if
a file has several open instances.

The first instance’s file object. It can even be read-only and accept paging
writes.

  1. Is it possible that fileobjects are created outside of IRP_MJ_CREATE?

No. Too smart 3rd party software can do this without calling
Zw/Nt/IoCreateFile, but the IRP is mandatory.

  1. I want to deny opens of certain files in my filter driver. Is it
    good to be checking for FILE_ID’s? Checking on names has the very high
    overhead of converting a given path into a longpath. Do FILE_ID’s
    exist on every filesystem? Are file_id’s persistent across reboots?

Yes, and yes. But - on FATs, the file IDs are ruined by defrag.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

Thanks Max. That helps. Now if I want to trap the cases where FAT
FILE_ID’s change is it ok to be looking at FSCTL_MOVE_FILE’s and that
should give me the new FILE_ID, right?

Are there any other obvious cavaets in tracking a file by file_id,
especially if I am looking to attach to FAT, NTFS and possibly CDFS
too?

Thanks

On 4/20/05, Maxim S. Shatskih wrote:
> >1) which fileobject is used by Mm for paging io. SOP has a pointer to
> >the fileObject, but I want to know which fileObject would be used, if
> >a file has several open instances.
>
> The first instance’s file object. It can even be read-only and accept paging
> writes.
>
> >2) Is it possible that fileobjects are created outside of IRP_MJ_CREATE?
>
> No. Too smart 3rd party software can do this without calling
> Zw/Nt/IoCreateFile, but the IRP is mandatory.
>
> >3) I want to deny opens of certain files in my filter driver. Is it
> >good to be checking for FILE_ID’s? Checking on names has the very high
> >overhead of converting a given path into a longpath. Do FILE_ID’s
> >exist on every filesystem? Are file_id’s persistent across reboots?
>
> Yes, and yes. But - on FATs, the file IDs are ruined by defrag.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> —
> Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

>FILE_ID’s change is it ok to be looking at FSCTL_MOVE_FILE’s and that

should give me the new FILE_ID, right?

Yes. Re-query the ID after each FSCTL_MOVE_FILE on this file.

CDFS does not support any defrag FSCTLs, and maybe it does not support file IDs
too.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

CDFS not only supports file IDs it supports open by ID: see
CdOpenByFileId (create.c) for an example of this logic.

AFP (used by Services for Macintosh) was supported on NTFS and CDFS;
since it is a stateless file system it needed open by file ID…

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2005 in Boston!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, April 20, 2005 4:38 PM
To: ntfsd redirect
Subject: Re: [ntfsd] questions on fileobjects, file_id etc.

FILE_ID’s change is it ok to be looking at FSCTL_MOVE_FILE’s and that
should give me the new FILE_ID, right?

Yes. Re-query the ID after each FSCTL_MOVE_FILE on this file.

CDFS does not support any defrag FSCTLs, and maybe it does not support
file IDs
too.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

From my experience NFS sharing protocols on top of NTFS volumes are
extensively using open by file_id. For example “Hummingbird NFS Maestro” or
“Microsoft Windows Software for UNIX (SFU)” and its NFS service.

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: 20. april 2005 22:50
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] questions on fileobjects, file_id etc.

CDFS not only supports file IDs it supports open by ID: see
CdOpenByFileId (create.c) for an example of this logic.

AFP (used by Services for Macintosh) was supported on NTFS and CDFS;
since it is a stateless file system it needed open by file ID…

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2005 in Boston!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, April 20, 2005 4:38 PM
To: ntfsd redirect
Subject: Re: [ntfsd] questions on fileobjects, file_id etc.

FILE_ID’s change is it ok to be looking at FSCTL_MOVE_FILE’s and that
should give me the new FILE_ID, right?

Yes. Re-query the ID after each FSCTL_MOVE_FILE on this file.

CDFS does not support any defrag FSCTLs, and maybe it does not support
file IDs
too.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Hi Maxim,

On 4/20/05, Maxim S. Shatskih wrote:
> >1) which fileobject is used by Mm for paging io. SOP has a pointer to
> >the fileObject, but I want to know which fileObject would be used, if
> >a file has several open instances.
>
> The first instance’s file object. It can even be read-only and accept paging
> writes.
>

Is it the first opened file object or the first file object used for a
read/write operation?
Since caching is initiated on first read/write and that’s when
CacheManager requests VM to create a section object for the file.
Thanks,
Pawan

There’s a subtle point to keep in mind here - namely, that Mm maintains
a file object reference (from the section) and Cc maintains a file
object reference (from the cache map). Usually these are the same - FSD
calls Cc to initiate caching, Cc passes the same file object to Mm to
initiate caching - just as you were asking about.

However, there are other possible sequences of operations here: memory
map the file first (file object passed to MmCreateSection is used) and
then access via read/write (different file object passed to
CcInitializeCacheMap). Or have the cache map torn down
(CcUninitializeCacheMap) but before Mm tears down its own state, Cc is
called to initiate caching again.

In these cases some operations will now arrive using one file object
(Mm) while others will appear using the other file object (Cc).

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Pawan Khatri
Sent: Thursday, April 21, 2005 2:58 AM
To: ntfsd redirect
Subject: Re: [ntfsd] questions on fileobjects, file_id etc.

Hi Maxim,

On 4/20/05, Maxim S. Shatskih wrote:
> >1) which fileobject is used by Mm for paging io. SOP has a pointer to
> >the fileObject, but I want to know which fileObject would be used, if
> >a file has several open instances.
>
> The first instance’s file object. It can even be read-only and accept
paging
> writes.
>

Is it the first opened file object or the first file object used for a
read/write operation?
Since caching is initiated on first read/write and that’s when
CacheManager requests VM to create a section object for the file.
Thanks,
Pawan


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

That is also true, but the original use of open by file ID (NT 3.1) was
Services for Macintosh. SFU has been added since that time. However,
AFP and NFS are rather similar (stateless file system protocols). SFM
worked with CDFS and NTFS. The NTFS implementation of open by file ID
is not included in the IFS Kit, but the CDFS implementation is.

Note that NTFS now supports returning the file ID in directory
enumerations - further improving performance for SFU in fact because it
is no longer necessary to open the file to retrieve the file ID - the
directory enumeration contains that information.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Primoz Beltram
Sent: Thursday, April 21, 2005 2:30 AM
To: ntfsd redirect
Subject: RE: [ntfsd] questions on fileobjects, file_id etc.

From my experience NFS sharing protocols on top of NTFS volumes are
extensively using open by file_id. For example “Hummingbird NFS Maestro”
or “Microsoft Windows Software for UNIX (SFU)” and its NFS service.

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: 20. april 2005 22:50
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] questions on fileobjects, file_id etc.

CDFS not only supports file IDs it supports open by ID: see
CdOpenByFileId (create.c) for an example of this logic.

AFP (used by Services for Macintosh) was supported on NTFS and CDFS;
since it is a stateless file system it needed open by file ID…

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2005 in Boston!

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Maxim S. Shatskih
Sent: Wednesday, April 20, 2005 4:38 PM
To: ntfsd redirect
Subject: Re: [ntfsd] questions on fileobjects, file_id etc.

FILE_ID’s change is it ok to be looking at FSCTL_MOVE_FILE’s and that
should give me the new FILE_ID, right?

Yes. Re-query the ID after each FSCTL_MOVE_FILE on this file.

CDFS does not support any defrag FSCTLs, and maybe it does not support
file IDs
too.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com