The data is read in the cache via paging io read requests. You will need to
monitor the paging IO path in ur filter driver.
-Kiran
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of vishnu chaitanya
Sent: Friday, June 10, 2005 12:06 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Regarding Cache Memory
hi all,
Im new to driver development. i recently bought IFS toolkit(Windows
Server 2003 Service Pack 1 and earlier). I started to analyse the spyfilter
sample in IFS toolkit. I attached the device to my “e: drive” now i wanted
to filter all file reading on that drive. When i opened the file for the
first time im getting the IRP_MJ_READ . But when i close the file and open
it againg im not getting IRP_MJ_READ not Fast I/O calls.
My understanding is that when a file is opened and close it stays in cache
memory and subsequent I/O calls will be done in cache memory. Is that
Right???
If so. how do i filter cache memory I/O operations? mainly Read operations.
Regards,
VC
http: — Questions? First
check the IFS FAQ at https://www.osronline.com/article.cfm?id=17 You are
currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’ To
unsubscribe send a blank email to xxxxx@lists.osr.com</http:>
hi
thanx for the reply.
i got one more doubt. In order to moniter the Paging I/O are there any IRPs
that i should look for or do i need to register any callbacks?
Regards,
VC
You have to look for IRP_PAGING_IO falg in irp->falgs.
-Kiran
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vishnu P
Sent: Friday, June 10, 2005 2:13 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Regarding Cache Memory
hi
thanx for the reply.
i got one more doubt. In order to moniter the Paging I/O are there any IRPs
that i should look for or do i need to register any callbacks?
Regards,
VC
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@calsoftinc.com To
unsubscribe send a blank email to xxxxx@lists.osr.com
im getting Paging IO read request only for the first time when the file is
opened. if i open the same file again im getting IRP_MJ_CREATE and Query
Fast IO, im not getting any read request.
im working on windows 2000 and notepad.exe as my test application.
“Kiran Joshi” wrote in message news:xxxxx@ntfsd…
> You have to look for IRP_PAGING_IO falg in irp->falgs.
> -Kiran
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Vishnu P
> Sent: Friday, June 10, 2005 2:13 PM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Regarding Cache Memory
>
> hi
>
> thanx for the reply.
>
> i got one more doubt. In order to moniter the Paging I/O are there any
IRPs
> that i should look for or do i need to register any callbacks?
>
> Regards,
>
> VC
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@calsoftinc.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> im getting Paging IO read request only for the first time when the file is
opened. if i open the same file again im getting IRP_MJ_CREATE and Query
Fast IO, im not getting any read request.
im working on windows 2000 and notepad.exe as my test application.
#1 You get paging IO only when the data are loaded to the cache or memory
mapped. Next time, the data are still in the cache so no need to read them
again
#2 Notepad uses memory mapped files (OMG, how many times I and others
wrote this ?), you will not see the cached read.
L.
im sorry to ask such question but im new to this group.
Is there a way in filter drivers to prevent files from being cached.
“Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> > im getting Paging IO read request only for the first time when the file
is
> > opened. if i open the same file again im getting IRP_MJ_CREATE and Query
> > Fast IO, im not getting any read request.
> > im working on windows 2000 and notepad.exe as my test application.
>
> #1 You get paging IO only when the data are loaded to the cache or memory
> mapped. Next time, the data are still in the cache so no need to read them
> again
>
> #2 Notepad uses memory mapped files (OMG, how many times I and others
> wrote this ?), you will not see the cached read.
>
> L.
>
>
This will absolutely kill the performance.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Vishnu P”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Friday, June 10, 2005 2:46 PM
Subject: Re:[ntfsd] Re:Regarding Cache Memory
> im sorry to ask such question but im new to this group.
>
> Is there a way in filter drivers to prevent files from being cached.
>
> “Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> > > im getting Paging IO read request only for the first time when the file
> is
> > > opened. if i open the same file again im getting IRP_MJ_CREATE and Query
> > > Fast IO, im not getting any read request.
> > > im working on windows 2000 and notepad.exe as my test application.
> >
> > #1 You get paging IO only when the data are loaded to the cache or memory
> > mapped. Next time, the data are still in the cache so no need to read them
> > again
> >
> > #2 Notepad uses memory mapped files (OMG, how many times I and others
> > wrote this ?), you will not see the cached read.
> >
> > L.
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
I know that.
#1 But the problem is I wanted to develop an encryption filter such that
only a set of applications(notepad.exe) can see the decrypted content and a
set of applications(word) should see it as encrypted. when notepad opens the
file. it stays in the cache. then if other applications opens the file they
also see the decrypted content. That’s the reason I wanted to prevent the
caching for the files.Is there a way I could resolve this problem?
#2 In IFS documentation I come across the following regarding
CcInitializecacheMap “Once CcInitializeCacheMap has been called by your file
system, it is possible for you to receive fast I/O operations for the file”.
Does that mean I get read, write operations from the cache?
Can I use the function in my filter driver?
#3 In documentation it says that CcPurgeCacheSection can be used to remove
purge the file data from the cache. Can I use it to purge the content. And I
suppose that it should be called in Close IRP of the file. Is that right?
Regards,
VC
“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> This will absolutely kill the performance.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> ----- Original Message -----
> From: “Vishnu P”
> Newsgroups: ntfsd
> To: “Windows File Systems Devs Interest List”
> Sent: Friday, June 10, 2005 2:46 PM
> Subject: Re:[ntfsd] Re:Regarding Cache Memory
>
>
> > im sorry to ask such question but im new to this group.
> >
> > Is there a way in filter drivers to prevent files from being cached.
> >
> > “Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> > > > im getting Paging IO read request only for the first time when the
file
> > is
> > > > opened. if i open the same file again im getting IRP_MJ_CREATE and
Query
> > > > Fast IO, im not getting any read request.
> > > > im working on windows 2000 and notepad.exe as my test application.
> > >
> > > #1 You get paging IO only when the data are loaded to the cache or
memory
> > > mapped. Next time, the data are still in the cache so no need to read
them
> > > again
> > >
> > > #2 Notepad uses memory mapped files (OMG, how many times I and others
> > > wrote this ?), you will not see the cached read.
> > >
> > > L.
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
I don’t think it is possible. You can block file accesses for particular
EXE names though. Just fail MJ_CREATE.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Vishnu P”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Saturday, June 11, 2005 11:46 AM
Subject: Re:[ntfsd] Re:Re:Regarding Cache Memory
> I know that.
>
> #1 But the problem is I wanted to develop an encryption filter such that
> only a set of applications(notepad.exe) can see the decrypted content and a
> set of applications(word) should see it as encrypted. when notepad opens the
> file. it stays in the cache. then if other applications opens the file they
> also see the decrypted content. That’s the reason I wanted to prevent the
> caching for the files.Is there a way I could resolve this problem?
>
> #2 In IFS documentation I come across the following regarding
> CcInitializecacheMap “Once CcInitializeCacheMap has been called by your file
> system, it is possible for you to receive fast I/O operations for the file”.
> Does that mean I get read, write operations from the cache?
> Can I use the function in my filter driver?
>
> #3 In documentation it says that CcPurgeCacheSection can be used to remove
> purge the file data from the cache. Can I use it to purge the content. And I
> suppose that it should be called in Close IRP of the file. Is that right?
>
> Regards,
> VC
>
> “Maxim S. Shatskih” wrote in message
> news:xxxxx@ntfsd…
> > This will absolutely kill the performance.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> > ----- Original Message -----
> > From: “Vishnu P”
> > Newsgroups: ntfsd
> > To: “Windows File Systems Devs Interest List”
> > Sent: Friday, June 10, 2005 2:46 PM
> > Subject: Re:[ntfsd] Re:Regarding Cache Memory
> >
> >
> > > im sorry to ask such question but im new to this group.
> > >
> > > Is there a way in filter drivers to prevent files from being cached.
> > >
> > > “Ladislav Zezula” wrote in message news:xxxxx@ntfsd…
> > > > > im getting Paging IO read request only for the first time when the
> file
> > > is
> > > > > opened. if i open the same file again im getting IRP_MJ_CREATE and
> Query
> > > > > Fast IO, im not getting any read request.
> > > > > im working on windows 2000 and notepad.exe as my test application.
> > > >
> > > > #1 You get paging IO only when the data are loaded to the cache or
> memory
> > > > mapped. Next time, the data are still in the cache so no need to read
> them
> > > > again
> > > >
> > > > #2 Notepad uses memory mapped files (OMG, how many times I and others
> > > > wrote this ?), you will not see the cached read.
> > > >
> > > > L.
> > > >
> > > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> > >
> > > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> I don’t think it is possible. You can block file accesses for
particular
EXE names though. Just fail MJ_CREATE.
It is possible, but not the way the poster thinks.
Some time ago, Tony Mason wrote that it can be achieved
using layered file system. But such filter this is damn hard
to develop. OSR’s Data Modification Kit should be
a generic software usable for writing such filter.
L.
Start over and look at the design. Don’t look at your ideas of the
implementation. Read about the cache manager and file systems. You can
write a file system that doesn’t use the cache manager, but you can’t
rewrite the standard ones. You do understand that Notepad is one of the
most difficult applications to support because it won’t work without
caching.
“Vishnu P” wrote in message news:xxxxx@ntfsd…
>I know that.
>
> #1 But the problem is I wanted to develop an encryption filter such that
> only a set of applications(notepad.exe) can see the decrypted content and
> a
> set of applications(word) should see it as encrypted. when notepad opens
> the
> file. it stays in the cache. then if other applications opens the file
> they
> also see the decrypted content. That’s the reason I wanted to prevent the
> caching for the files.Is there a way I could resolve this problem?
>
> #2 In IFS documentation I come across the following regarding
> CcInitializecacheMap “Once CcInitializeCacheMap has been called by your
> file
> system, it is possible for you to receive fast I/O operations for the
> file”.
> Does that mean I get read, write operations from the cache?
> Can I use the function in my filter driver?
>
> #3 In documentation it says that CcPurgeCacheSection can be used to remove
> purge the file data from the cache. Can I use it to purge the content. And
> I
> suppose that it should be called in Close IRP of the file. Is that right?
>
> Regards,
> VC
>
> “Maxim S. Shatskih” wrote in message
> news:xxxxx@ntfsd…
>> This will absolutely kill the performance.
>>
>> Maxim Shatskih, Windows DDK MVP
>> StorageCraft Corporation
>> xxxxx@storagecraft.com
>> http://www.storagecraft.com
>>
>> ----- Original Message -----
>> From: “Vishnu P”
>> Newsgroups: ntfsd
>> To: “Windows File Systems Devs Interest List”
>> Sent: Friday, June 10, 2005 2:46 PM
>> Subject: Re:[ntfsd] Re:Regarding Cache Memory
>>
>>
>> > im sorry to ask such question but im new to this group.
>> >
>> > Is there a way in filter drivers to prevent files from being cached.
>> >
>> > “Ladislav Zezula” wrote in message
>> > news:xxxxx@ntfsd…
>> > > > im getting Paging IO read request only for the first time when the
> file
>> > is
>> > > > opened. if i open the same file again im getting IRP_MJ_CREATE and
> Query
>> > > > Fast IO, im not getting any read request.
>> > > > im working on windows 2000 and notepad.exe as my test application.
>> > >
>> > > #1 You get paging IO only when the data are loaded to the cache or
> memory
>> > > mapped. Next time, the data are still in the cache so no need to read
> them
>> > > again
>> > >
>> > > #2 Notepad uses memory mapped files (OMG, how many times I and others
>> > > wrote this ?), you will not see the cached read.
>> > >
>> > > L.
>> > >
>> > >
>> >
>> >
>> >
>> > —
>> > Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>> >
>> > You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
>> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>
>
>