Re: Fast I/O Query Open

Hello Everybody,
I’ve encountered problems with Fast I/O Query Open requests
processing in my filter driver, based on code from Filemon sample.
The main idea of my driver is filtering the requests on
several files and fooling the IE and Netscape browsers under NT
that these files really exists on the disk.
I’ve succesfully done everything with common IRP_MJ_ create, close,
directory control, read requests and this all works.
But some apps cause the fast io requests, for example, Fast I/O
Query Open reqs.
what is the correct way to process fast io query call without
calling the lower level driver.
what I have to do with IRP stacks locations, with IRP, with
information structure.
or how can I cancel the fast query calls (I’ve noticed, that in FAT
case nobody sends me them, but IE 4.x & 5.x sends them when the target
files are situated on NTFS).
please do not refer me to books or ifs kits, i do not have any.
Best regards,
Perm mailto:xxxxx@perm.raid.ru


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

just cancel your FastIoQueryOpen routine with

return FALSE;

and the system will generate common IRP_MJ_CREATE

Kristian


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> But some apps cause the fast io requests, for example, Fast I/O

Query Open reqs.
what is the correct way to process fast io query call without
calling the lower level driver.
what I have to do with IRP stacks locations, with IRP, with
information structure.

FastIoQueryOpen is called as a result of NtQueryAttributesFile and IIRC some
similar syscall (don’t remember the name - it queries the file information
by its name too).
This is done to avoid going the full path of IRP_MJ_CREATE and then
IRP_MJ_QUERY_INFORMATION.
FastIoQueryOpen returns FALSE without touching anything when it wants to
force the IO manager to go the long IRP path.
Otherwise, it returns TRUE.

Some more rules:

  • use IoGetCurrentIrpStackLocation(Irp)->FileObject->FileName for the file
    name.
  • you must fill Irp->IoStatus.Status with failure or success status code
  • after you returned TRUE from FastIoQueryOpen, the FastIoQueryBasicInfo or
    FastIoQueryNetworkOpenInfo can be called in your driver to do the query, use
    the file object in it - it is the same file object as in FastIoQueryOpen.
  • if your filter passes the FastIoQueryOpen call to the FSD below - you must
    do the

IoGetCurrentIrpStackLocation(Irp)->DeviceObject = DeviceExtension
->TargetDeviceObject;

thing before calling the lower’s FastIoQueryOpen.

or how can I cancel the fast query calls (I’ve noticed, that in FAT
case nobody sends me them, but IE 4.x & 5.x sends them when the target
files are situated on NTFS).

Always return FALSE from FastIoQueryOpen - this will degrade the performance
a bit, but will work. IO manager will use the IRP path in this case.

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com