Reference Counting (from NTInsider article)

OSR_Community_User · July 3, 2002, 4:13pm

From the March-April issue of NTInsider, I’m trying to use the
Reference counting suggested for filters that are interested in I/O only
(reads and writes)
This approach suggests:

In IRP_MJ_CREATE, create per-file context structure, and
initialize it with lpFileObject->FsContext, or increment the reference
count if the FsContext is already in the list.
In IRP_MJ_CLOSE, decrement the reference count, if FO_STREAM_FILE
flag is NOT set
If reference count is zero, and both ImageSectionObject and
DataSectionObject are NON-zero (that’s what is said in the article),
delete the context structure
Just to check: is the NON-zero incorrect? If they are non-zero it
would mean there are still references from VM, not vice versa?

And, is this algorithm working? (I keep getting unknown
FsContexts in either case - check for NULL and non-NULL during
Read/Write)

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.

OSR_Community_User · July 3, 2002, 5:03pm

Dejan,

The last point there is (as you suspected) reversed. Those two fields should
BOTH be zero (NULL) to indicate there are no remaining references.

As for why you would observe files with contexts that you’ve never seen,
this can certainly happen if these are internal files for the file system
that represent meta-data control streams (the MFT, for example, or the DASD
volume.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Hope to see you at the next OSR file systems class in San Jose, CA September
16, 2002!

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@alfasp.com]
Sent: Wednesday, July 03, 2002 4:07 PM
To: File Systems Developers
Subject: [ntfsd] Reference Counting (from NTInsider article)

From the March-April issue of NTInsider, I’m trying to use the
Reference counting suggested for filters that are interested in I/O only
(reads and writes)
This approach suggests:

In IRP_MJ_CREATE, create per-file context structure, and
initialize it with lpFileObject->FsContext, or increment the reference
count if the FsContext is already in the list.
In IRP_MJ_CLOSE, decrement the reference count, if FO_STREAM_FILE
flag is NOT set
If reference count is zero, and both ImageSectionObject and
DataSectionObject are NON-zero (that’s what is said in the article),
delete the context structure
Just to check: is the NON-zero incorrect? If they are non-zero it
would mean there are still references from VM, not vice versa?

And, is this algorithm working? (I keep getting unknown
FsContexts in either case - check for NULL and non-NULL during
Read/Write)

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32
developers.
Alfa Registry Protector - Registry protection library for Win32
developers.

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · July 3, 2002, 5:09pm

You are protecting from the case where you increment your reference
count in the CREATE processing, then decrement it in the CLOSE when the
STREAM_FO comes in. Since these fileobjects don’t get created via the
IRP_MJ_CREATE.

What I do is as outlined in the article with the obvious error
corrected. If the ref count is zero and the Image and Data
sectionobjects are NULL, delete the context structure.

Don’t forget to protect against the deletepending possibility in this
approach though…

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>-----Original Message-----
>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
>Sent: Wednesday, July 03, 2002 2:07 PM
>To: File Systems Developers
>Subject: [ntfsd] Reference Counting (from NTInsider article)
>
>
> From the March-April issue of NTInsider, I’m trying to use the
>Reference counting suggested for filters that are interested in I/O
only
>(reads and writes)
> This approach suggests:
> - In IRP_MJ_CREATE, create per-file context structure, and
>initialize it with lpFileObject->FsContext, or increment the reference
>count if the FsContext is already in the list.
> - In IRP_MJ_CLOSE, decrement the reference count, if
FO_STREAM_FILE
>flag is NOT set
> - If reference count is zero, and both ImageSectionObject and
>DataSectionObject are NON-zero (that’s what is said in the article),
>delete the context structure
> Just to check: is the NON-zero incorrect? If they are non-zero it
>would mean there are still references from VM, not vice versa?
>
> And, is this algorithm working? (I keep getting unknown
>FsContexts in either case - check for NULL and non-NULL during
>Read/Write)
>
>–
>Kind regards, Dejan M. www.alfasp.com
>E-mail: xxxxx@alfasp.com ICQ#: 56570367
>Alfa File Monitor - File monitoring library for Win32 developers.
>Alfa File Protector - File protection and hiding library for Win32
>developers.
>Alfa Registry Monitor - Registry monitoring library for Win32
>developers.
>Alfa Registry Protector - Registry protection library for Win32
>developers.
>
>
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · July 3, 2002, 5:42pm

> What I do is as outlined in the article with the obvious error corrected.

If the ref count is zero and the Image and Data sectionobjects are NULL,
delete the context structure.

Yep. After adding some extra code to check some conditions, I seem
to have nailed the unknown FsContextx to MFT data AND directories. No files!
That’s probably good enough for me, but can anyone explain how come I’m
still getting unknown FsContexts for directories?

Don’t forget to protect against the deletepending possibility in this
approach though…

What exactly do you mean? I know that if I try to query FO after
FileDispositionInformation call succeeded, it will fail, but this is not
something that happens during my tests (I’m not deleting any files…)

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

OSR_Community_User · July 3, 2002, 9:47pm

> > Don’t forget to protect against the deletepending possibility in this

> approach though…

What exactly do you mean? I know that if I try to query FO after
FileDispositionInformation call succeeded, it will fail, but this is not
something that happens during my tests (I’m not deleting any files…)

The approach documeted in OSR Insider works well for me, during the close
operation, if the file object’s flag indicates it is a temporary file, or if
the file object has delete pending set, I delete the context structure.

Regards,
Sin-Lam

OSR_Community_User · July 4, 2002, 6:40am

Even if the Image and Data section objects are non NULL?

Tan Sin Lam wrote:

> What exactly do you mean? I know that if I try to query FO after
> FileDispositionInformation call succeeded, it will fail, but this is not
> something that happens during my tests (I’m not deleting any files…)
>

The approach documeted in OSR Insider works well for me, during the close
operation, if the file object’s flag indicates it is a temporary file, or if
the file object has delete pending set, I delete the context structure.

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

OSR_Community_User · July 5, 2002, 3:03am

I have a question regarding this mechanism. Is it really required to
maintain a reference count if the Section Object pointers are used to
delete the entry.

Can I rely on the SectionObject pointers when the reference count = 0? Or
can there be exceptions to this case?

Best regards,

Wim Vervoorn

Eltan Comm B.V.
Het Schild 13
5275 EB Den Dungen
The Netherlands

Tel. +31-(0)73-594 46 64
Fax. +31-(0)73-594 11 87
Email xxxxx@eltan.com

You are protecting from the case where you increment your reference
count in the CREATE processing, then decrement it in the CLOSE when the
STREAM_FO comes in. Since these fileobjects don’t get created via the
IRP_MJ_CREATE.

What I do is as outlined in the article with the obvious error
corrected. If the ref count is zero and the Image and Data
sectionobjects are NULL, delete the context structure.

Don’t forget to protect against the deletepending possibility in this
approach though…

Pete

Peter Scott
xxxxx@KernelDrivers.com
http://www.KernelDrivers.com

>>-----Original Message-----
>>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
>>xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
>>Sent: Wednesday, July 03, 2002 2:07 PM
>>To: File Systems Developers
>>Subject: [ntfsd] Reference Counting (from NTInsider article)
>>
>>
>> From the March-April issue of NTInsider, I’m trying to use the
>>Reference counting suggested for filters that are interested in I/O
only
>>(reads and writes)
>> This approach suggests:
>> - In IRP_MJ_CREATE, create per-file context structure, and
>>initialize it with lpFileObject->FsContext, or increment the reference
>>count if the FsContext is already in the list.
>> - In IRP_MJ_CLOSE, decrement the reference count, if
FO_STREAM_FILE
>>flag is NOT set
>> - If reference count is zero, and both ImageSectionObject and
>>DataSectionObject are NON-zero (that’s what is said in the article),
>>delete the context structure
>> Just to check: is the NON-zero incorrect? If they are non-zero it
>>would mean there are still references from VM, not vice versa?
>>
>> And, is this algorithm working? (I keep getting unknown
>>FsContexts in either case - check for NULL and non-NULL during
>>Read/Write)
>>
>>–
>>Kind regards, Dejan M. www.alfasp.com
>>E-mail: xxxxx@alfasp.com ICQ#: 56570367
>>Alfa File Monitor - File monitoring library for Win32 developers.
>>Alfa File Protector - File protection and hiding library for Win32
>>developers.
>>Alfa Registry Monitor - Registry monitoring library for Win32
>>developers.
>>Alfa Registry Protector - Registry protection library for Win32
>>developers.
>>
>>
>>
>>
>>—
>>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
>>To unsubscribe send a blank email to %%email.unsub%%

Dan_Partelly · July 7, 2002, 8:26am

>I have a question regarding this mechanism. Is it really required to

maintain a reference count if the Section Object pointers are used to
delete the entry.

Yes it is. Consider the case when a file is nor cached, nor memory mapped.
It’s still a valid stream, but those entryes will be 0. So , you need
reference counting.

> Can I rely on the SectionObject pointers when the reference count = 0?

You can. Neither Mm, neither Cc holds anymore references the stream.

----- Original Message -----
From: “Wim Vervoorn”
To: “File Systems Developers”
Sent: Friday, July 05, 2002 10:03 AM
Subject: [ntfsd] RE: Reference Counting (from NTInsider article)

> I have a question regarding this mechanism. Is it really required to
> maintain a reference count if the Section Object pointers are used to
> delete the entry.
>
> Can I rely on the SectionObject pointers when the reference count = 0? Or
> can there be exceptions to this case?
>
> Best regards,
>
> Wim Vervoorn
>
> Eltan Comm B.V.
> Het Schild 13
> 5275 EB Den Dungen
> The Netherlands
>
> Tel. +31-(0)73-594 46 64
> Fax. +31-(0)73-594 11 87
> Email xxxxx@eltan.com
>
>
> > You are protecting from the case where you increment your reference
> > count in the CREATE processing, then decrement it in the CLOSE when the
> > STREAM_FO comes in. Since these fileobjects don’t get created via the
> > IRP_MJ_CREATE.
> >
> > What I do is as outlined in the article with the obvious error
> > corrected. If the ref count is zero and the Image and Data
> > sectionobjects are NULL, delete the context structure.
> >
> > Don’t forget to protect against the deletepending possibility in this
> > approach though…
> >
> > Pete
> >
> > Peter Scott
> > xxxxx@KernelDrivers.com
> > http://www.KernelDrivers.com
> >
> >
> > >>-----Original Message-----
> > >>From: xxxxx@lists.osr.com [mailto:bounce-ntfsd-
> > >>xxxxx@lists.osr.com] On Behalf Of Dejan Maksimovic
> > >>Sent: Wednesday, July 03, 2002 2:07 PM
> > >>To: File Systems Developers
> > >>Subject: [ntfsd] Reference Counting (from NTInsider article)
> > >>
> > >>
> > >> From the March-April issue of NTInsider, I’m trying to use the
> > >>Reference counting suggested for filters that are interested in I/O
> > only
> > >>(reads and writes)
> > >> This approach suggests:
> > >> - In IRP_MJ_CREATE, create per-file context structure, and
> > >>initialize it with lpFileObject->FsContext, or increment the reference
> > >>count if the FsContext is already in the list.
> > >> - In IRP_MJ_CLOSE, decrement the reference count, if
> > FO_STREAM_FILE
> > >>flag is NOT set
> > >> - If reference count is zero, and both ImageSectionObject and
> > >>DataSectionObject are NON-zero (that’s what is said in the article),
> > >>delete the context structure
> > >> Just to check: is the NON-zero incorrect? If they are non-zero it
> > >>would mean there are still references from VM, not vice versa?
> > >>
> > >> And, is this algorithm working? (I keep getting unknown
> > >>FsContexts in either case - check for NULL and non-NULL during
> > >>Read/Write)
> > >>
> > >>–
> > >>Kind regards, Dejan M. www.alfasp.com
> > >>E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > >>Alfa File Monitor - File monitoring library for Win32 developers.
> > >>Alfa File Protector - File protection and hiding library for Win32
> > >>developers.
> > >>Alfa Registry Monitor - Registry monitoring library for Win32
> > >>developers.
> > >>Alfa Registry Protector - Registry protection library for Win32
> > >>developers.
> > >>
> > >>
> > >>
> > >>
> > >>—
> > >>You are currently subscribed to ntfsd as: xxxxx@KernelDrivers.com
> > >>To unsubscribe send a blank email to %%email.unsub%%
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

OSR_Community_User · July 9, 2002, 1:44pm

What operations are performed with the “unknown” FsContext’s for directories? If the operations are IRP_MJ_READ, WRITE, and SET_INFORMATION with FileEndOfFile this is expected. Some of the file systems use stream files internally to access the directory structures they store on disk.

-----Original Message-----
From: Dejan Maksimovic [mailto:xxxxx@alfasp.com]
Sent: Wednesday, July 03, 2002 4:34 PM
To: File Systems Developers
Subject: [ntfsd] RE: Reference Counting (from NTInsider article)

What I do is as outlined in the article with the obvious error corrected.
If the ref count is zero and the Image and Data sectionobjects are NULL,
delete the context structure.

Yep. After adding some extra code to check some conditions, I seem
to have nailed the unknown FsContextx to MFT data AND directories. No files!
That’s probably good enough for me, but can anyone explain how come I’m
still getting unknown FsContexts for directories?

Don’t forget to protect against the deletepending possibility in this
approach though…

What exactly do you mean? I know that if I try to query FO after
FileDispositionInformation call succeeded, it will fail, but this is not
something that happens during my tests (I’m not deleting any files…)

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

You are currently subscribed to ntfsd as: xxxxx@inin.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · July 9, 2002, 6:41pm

Yes, those operations. Thanks, I think this sums up all the FsContext stuff.

“Fuller, Rob” wrote:

What operations are performed with the “unknown” FsContext’s for directories? If the operations are IRP_MJ_READ, WRITE, and SET_INFORMATION with FileEndOfFile this is expected. Some of the file systems use stream files internally to access the directory structures they store on disk.

–
Kind regards, Dejan M. www.alfasp.com
E-mail: xxxxx@alfasp.com ICQ#: 56570367
Alfa File Monitor - File monitoring library for Win32 developers.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa Registry Monitor - Registry monitoring library for Win32 developers.
Alfa Registry Protector - Registry protection library for Win32 developers.

Alexey_Logachyov · July 22, 2002, 3:50am

Where can I read this article (if I can)?

----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Wednesday, July 03, 2002 11:07 PM
Subject: [ntfsd] Reference Counting (from NTInsider article)

>
> From the March-April issue of NTInsider, I’m trying to use the
> Reference counting suggested for filters that are interested in I/O only
> (reads and writes)
> This approach suggests:
> - In IRP_MJ_CREATE, create per-file context structure, and
> initialize it with lpFileObject->FsContext, or increment the reference
> count if the FsContext is already in the list.
> - In IRP_MJ_CLOSE, decrement the reference count, if FO_STREAM_FILE
> flag is NOT set
> - If reference count is zero, and both ImageSectionObject and
> DataSectionObject are NON-zero (that’s what is said in the article),
> delete the context structure
> Just to check: is the NON-zero incorrect? If they are non-zero it
> would mean there are still references from VM, not vice versa?
>
> And, is this algorithm working? (I keep getting unknown
> FsContexts in either case - check for NULL and non-NULL during
> Read/Write)
>
> –
> Kind regards, Dejan M. www.alfasp.com
> E-mail: xxxxx@alfasp.com ICQ#: 56570367
> Alfa File Monitor - File monitoring library for Win32 developers.
> Alfa File Protector - File protection and hiding library for Win32
> developers.
> Alfa Registry Monitor - Registry monitoring library for Win32
> developers.
> Alfa Registry Protector - Registry protection library for Win32
> developers.
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

Dan_Partelly · July 22, 2002, 6:31am

Only on paper, in last NTInsider magazine.

Dan

----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 10:48 AM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> Where can I read this article (if I can)?
>
> ----- Original Message -----
> From: “Dejan Maksimovic”
> To: “File Systems Developers”
> Sent: Wednesday, July 03, 2002 11:07 PM
> Subject: [ntfsd] Reference Counting (from NTInsider article)
>
>
> >
> > From the March-April issue of NTInsider, I’m trying to use the
> > Reference counting suggested for filters that are interested in I/O only
> > (reads and writes)
> > This approach suggests:
> > - In IRP_MJ_CREATE, create per-file context structure, and
> > initialize it with lpFileObject->FsContext, or increment the reference
> > count if the FsContext is already in the list.
> > - In IRP_MJ_CLOSE, decrement the reference count, if FO_STREAM_FILE
> > flag is NOT set
> > - If reference count is zero, and both ImageSectionObject and
> > DataSectionObject are NON-zero (that’s what is said in the article),
> > delete the context structure
> > Just to check: is the NON-zero incorrect? If they are non-zero it
> > would mean there are still references from VM, not vice versa?
> >
> > And, is this algorithm working? (I keep getting unknown
> > FsContexts in either case - check for NULL and non-NULL during
> > Read/Write)
> >
> > –
> > Kind regards, Dejan M. www.alfasp.com
> > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > Alfa File Monitor - File monitoring library for Win32 developers.
> > Alfa File Protector - File protection and hiding library for Win32
> > developers.
> > Alfa Registry Monitor - Registry monitoring library for Win32
> > developers.
> > Alfa Registry Protector - Registry protection library for Win32
> > developers.
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

Alexey_Logachyov · July 22, 2002, 8:07am

Does it mean that I have to buy it?

----- Original Message -----
From: “Dan Partelly”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 1:10 PM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> Only on paper, in last NTInsider magazine.
>
> Dan
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “File Systems Developers”
> Sent: Monday, July 22, 2002 10:48 AM
> Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
>
>
> > Where can I read this article (if I can)?
> >
> > ----- Original Message -----
> > From: “Dejan Maksimovic”
> > To: “File Systems Developers”
> > Sent: Wednesday, July 03, 2002 11:07 PM
> > Subject: [ntfsd] Reference Counting (from NTInsider article)
> >
> >
> > >
> > > From the March-April issue of NTInsider, I’m trying to use the
> > > Reference counting suggested for filters that are interested in I/O
only
> > > (reads and writes)
> > > This approach suggests:
> > > - In IRP_MJ_CREATE, create per-file context structure, and
> > > initialize it with lpFileObject->FsContext, or increment the reference
> > > count if the FsContext is already in the list.
> > > - In IRP_MJ_CLOSE, decrement the reference count, if
FO_STREAM_FILE
> > > flag is NOT set
> > > - If reference count is zero, and both ImageSectionObject and
> > > DataSectionObject are NON-zero (that’s what is said in the article),
> > > delete the context structure
> > > Just to check: is the NON-zero incorrect? If they are non-zero it
> > > would mean there are still references from VM, not vice versa?
> > >
> > > And, is this algorithm working? (I keep getting unknown
> > > FsContexts in either case - check for NULL and non-NULL during
> > > Read/Write)
> > >
> > > –
> > > Kind regards, Dejan M. www.alfasp.com
> > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > Alfa File Monitor - File monitoring library for Win32 developers.
> > > Alfa File Protector - File protection and hiding library for Win32
> > > developers.
> > > Alfa Registry Monitor - Registry monitoring library for Win32
> > > developers.
> > > Alfa Registry Protector - Registry protection library for Win32
> > > developers.
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

Dan_Partelly · July 22, 2002, 8:12am

Check that with OSR. The core of the article was dicussed in an earlyer
thread, should be enough for implementing the lite reference counting model
for fsf interested only in IO.

Dan

----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 3:05 PM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> Does it mean that I have to buy it?
>
> ----- Original Message -----
> From: “Dan Partelly”
> To: “File Systems Developers”
> Sent: Monday, July 22, 2002 1:10 PM
> Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
>
>
> > Only on paper, in last NTInsider magazine.
> >
> > Dan
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “File Systems Developers”
> > Sent: Monday, July 22, 2002 10:48 AM
> > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> >
> >
> > > Where can I read this article (if I can)?
> > >
> > > ----- Original Message -----
> > > From: “Dejan Maksimovic”
> > > To: “File Systems Developers”
> > > Sent: Wednesday, July 03, 2002 11:07 PM
> > > Subject: [ntfsd] Reference Counting (from NTInsider article)
> > >
> > >
> > > >
> > > > From the March-April issue of NTInsider, I’m trying to use the
> > > > Reference counting suggested for filters that are interested in I/O
> only
> > > > (reads and writes)
> > > > This approach suggests:
> > > > - In IRP_MJ_CREATE, create per-file context structure, and
> > > > initialize it with lpFileObject->FsContext, or increment the
reference
> > > > count if the FsContext is already in the list.
> > > > - In IRP_MJ_CLOSE, decrement the reference count, if
> FO_STREAM_FILE
> > > > flag is NOT set
> > > > - If reference count is zero, and both ImageSectionObject and
> > > > DataSectionObject are NON-zero (that’s what is said in the article),
> > > > delete the context structure
> > > > Just to check: is the NON-zero incorrect? If they are non-zero
it
> > > > would mean there are still references from VM, not vice versa?
> > > >
> > > > And, is this algorithm working? (I keep getting unknown
> > > > FsContexts in either case - check for NULL and non-NULL during
> > > > Read/Write)
> > > >
> > > > –
> > > > Kind regards, Dejan M. www.alfasp.com
> > > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > > Alfa File Monitor - File monitoring library for Win32 developers.
> > > > Alfa File Protector - File protection and hiding library for Win32
> > > > developers.
> > > > Alfa Registry Monitor - Registry monitoring library for Win32
> > > > developers.
> > > > Alfa Registry Protector - Registry protection library for Win32
> > > > developers.
> > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

Alexey_Logachyov · July 22, 2002, 8:31am

By the way, what exactly means “interested only in IO”?

----- Original Message -----
From: “Dan Partelly”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 2:51 PM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> Check that with OSR. The core of the article was dicussed in an earlyer
> thread, should be enough for implementing the lite reference counting
model
> for fsf interested only in IO.
>
> Dan
>
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “File Systems Developers”
> Sent: Monday, July 22, 2002 3:05 PM
> Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
>
>
> > Does it mean that I have to buy it?
> >
> > ----- Original Message -----
> > From: “Dan Partelly”
> > To: “File Systems Developers”
> > Sent: Monday, July 22, 2002 1:10 PM
> > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> >
> >
> > > Only on paper, in last NTInsider magazine.
> > >
> > > Dan
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “File Systems Developers”
> > > Sent: Monday, July 22, 2002 10:48 AM
> > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > >
> > >
> > > > Where can I read this article (if I can)?
> > > >
> > > > ----- Original Message -----
> > > > From: “Dejan Maksimovic”
> > > > To: “File Systems Developers”
> > > > Sent: Wednesday, July 03, 2002 11:07 PM
> > > > Subject: [ntfsd] Reference Counting (from NTInsider article)
> > > >
> > > >
> > > > >
> > > > > From the March-April issue of NTInsider, I’m trying to use the
> > > > > Reference counting suggested for filters that are interested in
I/O
> > only
> > > > > (reads and writes)
> > > > > This approach suggests:
> > > > > - In IRP_MJ_CREATE, create per-file context structure, and
> > > > > initialize it with lpFileObject->FsContext, or increment the
> reference
> > > > > count if the FsContext is already in the list.
> > > > > - In IRP_MJ_CLOSE, decrement the reference count, if
> > FO_STREAM_FILE
> > > > > flag is NOT set
> > > > > - If reference count is zero, and both ImageSectionObject and
> > > > > DataSectionObject are NON-zero (that’s what is said in the
article),
> > > > > delete the context structure
> > > > > Just to check: is the NON-zero incorrect? If they are non-zero
> it
> > > > > would mean there are still references from VM, not vice versa?
> > > > >
> > > > > And, is this algorithm working? (I keep getting unknown
> > > > > FsContexts in either case - check for NULL and non-NULL during
> > > > > Read/Write)
> > > > >
> > > > > –
> > > > > Kind regards, Dejan M. www.alfasp.com
> > > > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > > > Alfa File Monitor - File monitoring library for Win32 developers.
> > > > > Alfa File Protector - File protection and hiding library for Win32
> > > > > developers.
> > > > > Alfa Registry Monitor - Registry monitoring library for Win32
> > > > > developers.
> > > > > Alfa Registry Protector - Registry protection library for Win32
> > > > > developers.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>

Dan_Partelly · July 22, 2002, 8:41am

Sorry I wanted to say data operations IO, namely IRP_MJ_READ &&
IRP_MJ_WRITE.

----- Original Message -----
From: “Alexey Logachyov”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 3:28 PM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> By the way, what exactly means “interested only in IO”?
>
> ----- Original Message -----
> From: “Dan Partelly”
> To: “File Systems Developers”
> Sent: Monday, July 22, 2002 2:51 PM
> Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
>
>
> > Check that with OSR. The core of the article was dicussed in an earlyer
> > thread, should be enough for implementing the lite reference counting
> model
> > for fsf interested only in IO.
> >
> > Dan
> >
> >
> > ----- Original Message -----
> > From: “Alexey Logachyov”
> > To: “File Systems Developers”
> > Sent: Monday, July 22, 2002 3:05 PM
> > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> >
> >
> > > Does it mean that I have to buy it?
> > >
> > > ----- Original Message -----
> > > From: “Dan Partelly”
> > > To: “File Systems Developers”
> > > Sent: Monday, July 22, 2002 1:10 PM
> > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > >
> > >
> > > > Only on paper, in last NTInsider magazine.
> > > >
> > > > Dan
> > > >
> > > > ----- Original Message -----
> > > > From: “Alexey Logachyov”
> > > > To: “File Systems Developers”
> > > > Sent: Monday, July 22, 2002 10:48 AM
> > > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > > >
> > > >
> > > > > Where can I read this article (if I can)?
> > > > >
> > > > > ----- Original Message -----
> > > > > From: “Dejan Maksimovic”
> > > > > To: “File Systems Developers”
> > > > > Sent: Wednesday, July 03, 2002 11:07 PM
> > > > > Subject: [ntfsd] Reference Counting (from NTInsider article)
> > > > >
> > > > >
> > > > > >
> > > > > > From the March-April issue of NTInsider, I’m trying to use
the
> > > > > > Reference counting suggested for filters that are interested in
> I/O
> > > only
> > > > > > (reads and writes)
> > > > > > This approach suggests:
> > > > > > - In IRP_MJ_CREATE, create per-file context structure, and
> > > > > > initialize it with lpFileObject->FsContext, or increment the
> > reference
> > > > > > count if the FsContext is already in the list.
> > > > > > - In IRP_MJ_CLOSE, decrement the reference count, if
> > > FO_STREAM_FILE
> > > > > > flag is NOT set
> > > > > > - If reference count is zero, and both ImageSectionObject
and
> > > > > > DataSectionObject are NON-zero (that’s what is said in the
> article),
> > > > > > delete the context structure
> > > > > > Just to check: is the NON-zero incorrect? If they are
non-zero
> > it
> > > > > > would mean there are still references from VM, not vice versa?
> > > > > >
> > > > > > And, is this algorithm working? (I keep getting unknown
> > > > > > FsContexts in either case - check for NULL and non-NULL during
> > > > > > Read/Write)
> > > > > >
> > > > > > –
> > > > > > Kind regards, Dejan M. www.alfasp.com
> > > > > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > > > > Alfa File Monitor - File monitoring library for Win32
developers.
> > > > > > Alfa File Protector - File protection and hiding library for
Win32
> > > > > > developers.
> > > > > > Alfa Registry Monitor - Registry monitoring library for Win32
> > > > > > developers.
> > > > > > Alfa Registry Protector - Registry protection library for Win32
> > > > > > developers.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

Alexey_Logachyov · July 22, 2002, 10:20am

What if I’m basicly interested in
IRP_MJ_CREATE/IRP_MJ_CLOSE/IRP_MJ_SET_INFORMATION/IRP_MJ_WRITE (FSF for
antivirus monitor). How stricy is that “only”?

----- Original Message -----
From: “Dan Partelly”
To: “File Systems Developers”
Sent: Monday, July 22, 2002 3:20 PM
Subject: [ntfsd] Re: Reference Counting (from NTInsider article)

> Sorry I wanted to say data operations IO, namely IRP_MJ_READ &&
> IRP_MJ_WRITE.
>
>
> ----- Original Message -----
> From: “Alexey Logachyov”
> To: “File Systems Developers”
> Sent: Monday, July 22, 2002 3:28 PM
> Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
>
>
> > By the way, what exactly means “interested only in IO”?
> >
> > ----- Original Message -----
> > From: “Dan Partelly”
> > To: “File Systems Developers”
> > Sent: Monday, July 22, 2002 2:51 PM
> > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> >
> >
> > > Check that with OSR. The core of the article was dicussed in an
earlyer
> > > thread, should be enough for implementing the lite reference counting
> > model
> > > for fsf interested only in IO.
> > >
> > > Dan
> > >
> > >
> > > ----- Original Message -----
> > > From: “Alexey Logachyov”
> > > To: “File Systems Developers”
> > > Sent: Monday, July 22, 2002 3:05 PM
> > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > >
> > >
> > > > Does it mean that I have to buy it?
> > > >
> > > > ----- Original Message -----
> > > > From: “Dan Partelly”
> > > > To: “File Systems Developers”
> > > > Sent: Monday, July 22, 2002 1:10 PM
> > > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > > >
> > > >
> > > > > Only on paper, in last NTInsider magazine.
> > > > >
> > > > > Dan
> > > > >
> > > > > ----- Original Message -----
> > > > > From: “Alexey Logachyov”
> > > > > To: “File Systems Developers”
> > > > > Sent: Monday, July 22, 2002 10:48 AM
> > > > > Subject: [ntfsd] Re: Reference Counting (from NTInsider article)
> > > > >
> > > > >
> > > > > > Where can I read this article (if I can)?
> > > > > >
> > > > > > ----- Original Message -----
> > > > > > From: “Dejan Maksimovic”
> > > > > > To: “File Systems Developers”
> > > > > > Sent: Wednesday, July 03, 2002 11:07 PM
> > > > > > Subject: [ntfsd] Reference Counting (from NTInsider article)
> > > > > >
> > > > > >
> > > > > > >
> > > > > > > From the March-April issue of NTInsider, I’m trying to use
> the
> > > > > > > Reference counting suggested for filters that are interested
in
> > I/O
> > > > only
> > > > > > > (reads and writes)
> > > > > > > This approach suggests:
> > > > > > > - In IRP_MJ_CREATE, create per-file context structure, and
> > > > > > > initialize it with lpFileObject->FsContext, or increment the
> > > reference
> > > > > > > count if the FsContext is already in the list.
> > > > > > > - In IRP_MJ_CLOSE, decrement the reference count, if
> > > > FO_STREAM_FILE
> > > > > > > flag is NOT set
> > > > > > > - If reference count is zero, and both ImageSectionObject
> and
> > > > > > > DataSectionObject are NON-zero (that’s what is said in the
> > article),
> > > > > > > delete the context structure
> > > > > > > Just to check: is the NON-zero incorrect? If they are
> non-zero
> > > it
> > > > > > > would mean there are still references from VM, not vice versa?
> > > > > > >
> > > > > > > And, is this algorithm working? (I keep getting unknown
> > > > > > > FsContexts in either case - check for NULL and non-NULL during
> > > > > > > Read/Write)
> > > > > > >
> > > > > > > –
> > > > > > > Kind regards, Dejan M. www.alfasp.com
> > > > > > > E-mail: xxxxx@alfasp.com ICQ#: 56570367
> > > > > > > Alfa File Monitor - File monitoring library for Win32
> developers.
> > > > > > > Alfa File Protector - File protection and hiding library for
> Win32
> > > > > > > developers.
> > > > > > > Alfa Registry Monitor - Registry monitoring library for Win32
> > > > > > > developers.
> > > > > > > Alfa Registry Protector - Registry protection library for
Win32
> > > > > > > developers.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > —
> > > > > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to %%email.unsub%%
>