receive IRP_MJ_WRITE request after finished IRP_MJ_CLEANUP

NTFSD
1

HI all,

I’m developing HSM filter driver on Windows 2003.
My filter driver received IRP_MJ_WRITE(Paging IO) after IRP_MJ_CLEANUP.
It does not happen on SP1 or before.

When driver received IRP_MJ_CLEANUP( and refcount==1 ),
The driver treat the file that all data was flushed.
But driver received The IRP_MJ_WRITE.
This is not good for my driver.
Because my driver run specific process after IRP_MJ_CLEANUP was completed.

My driver calls CcFlushCache() , CcPurgeCacheSection(), and
CcUninitializeCacheMap()
when recevied IRP_MJ_CLEANUP.
I checked all data was flushed by calling CcGetFlushedValidData().

It looks like Memory Manager problem that MM could not know that the data
was flushed or not by Cache Manager.

This problem happened when write mor larger files than 4GB into multiple
volumes at same time.

I want my driver to wait when My driver calls MmFlushImageSection(), but it
did not effected.
Anyone know how to detect that M/M will write data ?

#Sorry for my poor English.

Thanks,
T.Suzuki

2

I think the answer is simple. From the time of the IRP_MJ_CLEANUP until
IRP_MJ_CLOSE the only permissible requests will have the paging IO bit set.
They will also have the top level IRP be a non-zero. If you make the
assumptions you indicate, then you cannot work in the Windows environment.
That it only occurs in some special circumstances does not mean it cannot
occur at other times. New versions of Windows, service packs, and updates
may change behaviors at any time.

“Takashi Suzuki” wrote in message
news:xxxxx@ntfsd…
> HI all,
>
> I’m developing HSM filter driver on Windows 2003.
> My filter driver received IRP_MJ_WRITE(Paging IO) after IRP_MJ_CLEANUP.
> It does not happen on SP1 or before.
>
> When driver received IRP_MJ_CLEANUP( and refcount==1 ),
> The driver treat the file that all data was flushed.
> But driver received The IRP_MJ_WRITE.
> This is not good for my driver.
> Because my driver run specific process after IRP_MJ_CLEANUP was completed.
>
> My driver calls CcFlushCache() , CcPurgeCacheSection(), and
> CcUninitializeCacheMap()
> when recevied IRP_MJ_CLEANUP.
> I checked all data was flushed by calling CcGetFlushedValidData().
>
>
> It looks like Memory Manager problem that MM could not know that the data
> was flushed or not by Cache Manager.
>
> This problem happened when write mor larger files than 4GB into multiple
> volumes at same time.
>
> I want my driver to wait when My driver calls MmFlushImageSection(), but
> it did not effected.
> Anyone know how to detect that M/M will write data ?
>
> #Sorry for my poor English.
>
> Thanks,
> T.Suzuki
>

3

Sorry, but you have encountered the cache management problems that have been
discussed here many times. There is no way to know if your are going to see
additional writes from the cache, or for that matter how long it will be
before the writes occur.

You are going to have to either wait for the IRP_MJ_CLOSE of the file object
(which can be days) or else you will have to manage things yourself with a
secondary file object and other complexity.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
Remove StopSpam to reply

“Takashi Suzuki” wrote in message
news:xxxxx@ntfsd…
> HI all,
>
> I’m developing HSM filter driver on Windows 2003.
> My filter driver received IRP_MJ_WRITE(Paging IO) after IRP_MJ_CLEANUP.
> It does not happen on SP1 or before.
>
> When driver received IRP_MJ_CLEANUP( and refcount==1 ),
> The driver treat the file that all data was flushed.
> But driver received The IRP_MJ_WRITE.
> This is not good for my driver.
> Because my driver run specific process after IRP_MJ_CLEANUP was completed.
>
> My driver calls CcFlushCache() , CcPurgeCacheSection(), and
> CcUninitializeCacheMap()
> when recevied IRP_MJ_CLEANUP.
> I checked all data was flushed by calling CcGetFlushedValidData().
>
>
> It looks like Memory Manager problem that MM could not know that the data
> was flushed or not by Cache Manager.
>
> This problem happened when write mor larger files than 4GB into multiple
> volumes at same time.
>
> I want my driver to wait when My driver calls MmFlushImageSection(), but
> it did not effected.
> Anyone know how to detect that M/M will write data ?
>
> #Sorry for my poor English.
>
> Thanks,
> T.Suzuki
>

4

VISTA WDK:
others have elequently answered but here is the official word from the ddk:
IRP_MJ_CLEANUP When Sent

Receipt of the IRP_MJ_CLEANUP request indicates that the handle reference
count on a file object has reached zero. (In other words, all handles to the
file object have been closed.) Often it is sent when a user-mode application
has called the Microsoft Win32 *CloseHandle* function (or when a kernel-mode
driver has called *ZwClose*) on the last outstanding handle to a file
object.

It is important to note that when all handles to a file object have been
closed, this does not necessarily mean that the file object is no longer
being used. System components, such as the Cache Manager and the Memory
Manager, might hold outstanding references to the file object. These
components can still read to or write from a file, even after an
IRP_MJ_CLEANUP request is received.

On 10/4/07, Don Burn wrote:
>
> Sorry, but you have encountered the cache management problems that have
> been
> discussed here many times. There is no way to know if your are going to
> see
> additional writes from the cache, or for that matter how long it will be
> before the writes occur.
>
> You are going to have to either wait for the IRP_MJ_CLOSE of the file
> object
> (which can be days) or else you will have to manage things yourself with a
> secondary file object and other complexity.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
> Remove StopSpam to reply
>
>
> “Takashi Suzuki” wrote in message
> news:xxxxx@ntfsd…
> > HI all,
> >
> > I’m developing HSM filter driver on Windows 2003.
> > My filter driver received IRP_MJ_WRITE(Paging IO) after IRP_MJ_CLEANUP.
> > It does not happen on SP1 or before.
> >
> > When driver received IRP_MJ_CLEANUP( and refcount==1 ),
> > The driver treat the file that all data was flushed.
> > But driver received The IRP_MJ_WRITE.
> > This is not good for my driver.
> > Because my driver run specific process after IRP_MJ_CLEANUP was
> completed.
> >
> > My driver calls CcFlushCache() , CcPurgeCacheSection(), and
> > CcUninitializeCacheMap()
> > when recevied IRP_MJ_CLEANUP.
> > I checked all data was flushed by calling CcGetFlushedValidData().
> >
> >
> > It looks like Memory Manager problem that MM could not know that the
> data
> > was flushed or not by Cache Manager.
> >
> > This problem happened when write mor larger files than 4GB into multiple
> > volumes at same time.
> >
> > I want my driver to wait when My driver calls MmFlushImageSection(), but
> > it did not effected.
> > Anyone know how to detect that M/M will write data ?
> >
> > #Sorry for my poor English.
> >
> > Thanks,
> > T.Suzuki
> >
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

5

Thanks for reply, guys.

I misunderstood about IRP_MJ_CLEANUP.
I try to change that my driver processes IRP_MJ_WRITE after IRP_MJ_CLEANUP.

But , I wonder why Memory Manager send IRP_MJ_WRITE after CcFlushCache with
“FileOffset is NULL”.
It looks like that the IRP_MJ_WRITE writes same data twice…

“Takashi Suzuki” wrote in message
news:xxxxx@ntfsd…
> HI all,
>
> I’m developing HSM filter driver on Windows 2003.
> My filter driver received IRP_MJ_WRITE(Paging IO) after IRP_MJ_CLEANUP.
> It does not happen on SP1 or before.
>
> When driver received IRP_MJ_CLEANUP( and refcount==1 ),
> The driver treat the file that all data was flushed.
> But driver received The IRP_MJ_WRITE.
> This is not good for my driver.
> Because my driver run specific process after IRP_MJ_CLEANUP was completed.
>
> My driver calls CcFlushCache() , CcPurgeCacheSection(), and
> CcUninitializeCacheMap()
> when recevied IRP_MJ_CLEANUP.
> I checked all data was flushed by calling CcGetFlushedValidData().
>
>
> It looks like Memory Manager problem that MM could not know that the data
> was flushed or not by Cache Manager.
>
> This problem happened when write mor larger files than 4GB into multiple
> volumes at same time.
>
> I want my driver to wait when My driver calls MmFlushImageSection(), but
> it did not effected.
> Anyone know how to detect that M/M will write data ?
>
> #Sorry for my poor English.
>
> Thanks,
> T.Suzuki
>