Can a file system driver return STATUS_PENDING from IRP_MJ_CREATE and
IRP_MJ_CLOSE? I found a document on micorsoft.com which says that a FSFD
should never return STATUS_PENDING. I’m testing my driver on several
machines and never see STATUS_PENDING returned. But when I started
development of the driver initial tests showed that STATUS_PENDING is
possible from IRP_MJ_CLOSE dispatch function.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
IRP_MJ_CLOSE can and does many times return STATUS_PENDING.
IIRC, the file system WON’T return STATUS_PENDING, except on floppies
for IRP_MJ_CREATE, but some filters can.
Regards, Dejan.
Alexey Logachyov wrote:
Can a file system driver return STATUS_PENDING from IRP_MJ_CREATE and
IRP_MJ_CLOSE? I found a document on micorsoft.com which says that a FSFD
should never return STATUS_PENDING. I’m testing my driver on several
machines and never see STATUS_PENDING returned. But when I started
development of the driver initial tests showed that STATUS_PENDING is
possible from IRP_MJ_CLOSE dispatch function.
You are currently subscribed to ntfsd as: xxxxx@alfasp.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I’vee a little test. In IRP_MJ_CLOSE dispatch routine I copy IRP stack
location to next, set completion routing, and call IoCallDriver.
IoCallDriver sometimes does return STATUS_PENDING but in completion routine
Irp->PendingReturned is never set to TRUE. I also checked the
SL_PENDING_RETURNED in both current and next IRP stack location but it is
never set too. Does that mean that FS driver does not call IoMarkIrpPending?
I also encountered the next unexpected behaviour on NT4 SP6. FS driver’s
IRP_MJ_CLOSE dispatch routine often returns impossible status code (high
order byte is set to 0xF which means that the reserved bit is 1) though
Irp->IoStatus.Status is fine.
When can I return STATUS_PENDING from my FSFD? And why Microsoft states that
FSFDs should not return STATUS_PENDING? What’s gonna happen if FSFD returns
STATUS_PENDING then pass IRP to FSD and FSD in turn returns STATUS_PENDING
too?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Friday, October 19, 2001 5:56 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> IRP_MJ_CLOSE can and does many times return STATUS_PENDING.
> IIRC, the file system WON’T return STATUS_PENDING, except on floppies
> for IRP_MJ_CREATE, but some filters can.
>
> Regards, Dejan.
>
> Alexey Logachyov wrote:
>
> > Can a file system driver return STATUS_PENDING from IRP_MJ_CREATE and
> > IRP_MJ_CLOSE? I found a document on micorsoft.com which says that a FSFD
> > should never return STATUS_PENDING. I’m testing my driver on several
> > machines and never see STATUS_PENDING returned. But when I started
> > development of the driver initial tests showed that STATUS_PENDING is
> > possible from IRP_MJ_CLOSE dispatch function.
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
> developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> I also encountered the next unexpected behaviour on NT4 SP6. FS driver’s
IRP_MJ_CLOSE dispatch routine often returns impossible status code (high
order byte is set to 0xF which means that the reserved bit is 1) though
Irp->IoStatus.Status is fine.
I have found this to happen sometimes, but I think it is related to FSF
corrupting some memory.
When can I return STATUS_PENDING from my FSFD?
Anytime you want, virtually.
And why Microsoft states that FSFDs should not return STATUS_PENDING?
For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many filters or FSD
might need the original process context - which if any FSFD returns
STATUS_PENDING will not be available, due to the processing being done in a
worker thread.
What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to FSD and
FSD in turn returns STATUS_PENDING too?
If the FSFD is well written the result you want will happen. I.e. if the
FSFD handles STATUS_PENDING correctly, and pends correctly no problems will
occur.
It is quite possible for every FSFD in the chain and the FSD itself to
return STATUS_PENDING, and thus also get STATUS_PENDING from the device it
called.
What should you note: since you will call IoCallDriver from system worker
thread probably (you virtually said this above:-), if the IoCallDriver returns
STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
completion routine gets called for that IRP.
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I’m working on FSFD for anti-virus program and I thought it would be a good
idea to return STATUS_PENDING before starting checking for virus. You say
FSD wants to be in original process context. Is it possible after virus
check return to the original process context? May be some kind of APC?
And what about situation when IoCallDriver returns STATUS_PENDING but
IRP->PendingReturned is FALSE in completion routine?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:02 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I also encountered the next unexpected behaviour on NT4 SP6. FS driver’s
> > IRP_MJ_CLOSE dispatch routine often returns impossible status code (high
> > order byte is set to 0xF which means that the reserved bit is 1) though
> > Irp->IoStatus.Status is fine.
>
> I have found this to happen sometimes, but I think it is related to
FSF
> corrupting some memory.
>
> > When can I return STATUS_PENDING from my FSFD?
>
> Anytime you want, virtually.
>
> > And why Microsoft states that FSFDs should not return STATUS_PENDING?
>
> For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many filters
or FSD
> might need the original process context - which if any FSFD returns
> STATUS_PENDING will not be available, due to the processing being done in
a
> worker thread.
>
> > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to FSD
and
> > FSD in turn returns STATUS_PENDING too?
>
> If the FSFD is well written the result you want will happen. I.e. if
the
> FSFD handles STATUS_PENDING correctly, and pends correctly no problems
will
> occur.
> It is quite possible for every FSFD in the chain and the FSD itself to
> return STATUS_PENDING, and thus also get STATUS_PENDING from the device it
> called.
> What should you note: since you will call IoCallDriver from system
worker
> thread probably (you virtually said this above:-), if the IoCallDriver
returns
> STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> completion routine gets called for that IRP.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
May be this is a dumb question but what is FSF?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:02 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I also encountered the next unexpected behaviour on NT4 SP6. FS driver’s
> > IRP_MJ_CLOSE dispatch routine often returns impossible status code (high
> > order byte is set to 0xF which means that the reserved bit is 1) though
> > Irp->IoStatus.Status is fine.
>
> I have found this to happen sometimes, but I think it is related to
FSF
> corrupting some memory.
>
> > When can I return STATUS_PENDING from my FSFD?
>
> Anytime you want, virtually.
>
> > And why Microsoft states that FSFDs should not return STATUS_PENDING?
>
> For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many filters
or FSD
> might need the original process context - which if any FSFD returns
> STATUS_PENDING will not be available, due to the processing being done in
a
> worker thread.
>
> > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to FSD
and
> > FSD in turn returns STATUS_PENDING too?
>
> If the FSFD is well written the result you want will happen. I.e. if
the
> FSFD handles STATUS_PENDING correctly, and pends correctly no problems
will
> occur.
> It is quite possible for every FSFD in the chain and the FSD itself to
> return STATUS_PENDING, and thus also get STATUS_PENDING from the device it
> called.
> What should you note: since you will call IoCallDriver from system
worker
> thread probably (you virtually said this above:-), if the IoCallDriver
returns
> STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> completion routine gets called for that IRP.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> I’m working on FSFD for anti-virus program and I thought it would be a good
idea to return STATUS_PENDING before starting checking for virus. You say FSD
wants to be in original process context. Is it possible after virus
check return to the original process context? May be some kind of APC?
You can, but that’s bad.
The thing is, in IRP_MJ_CREATE you CAN return STATUS_PENDING, but you should
call IoCallDriver in Dispatch NOT in a worker thread.
Nothing says you can’t or that it won’t work.
The only reason why it might fail and cause a crash is if a Filter in the
chain doesn’t support STATUS_PENDING return, which isn’t your problem!
And what about situation when IoCallDriver returns STATUS_PENDING but
IRP->PendingReturned is FALSE in completion routine?
I think that one is for Hector from NT Insider.
Frankly, I don’t see a problem.
If I understand correctly, you want to:
- return STATUS_PENDING in IRP_MJ_CREATE dispatch
- return STATUS_MORE_PROCESSING_REQUIRED in completion
- call IoCallDriver in a worker thread initiated by the completion routine
- do IoCompleteRequest in the worker thread.
That’s quite OK.
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
File System Filter - just one of it’s many acronyms:-)
Alexey Logachyov wrote:
May be this is a dumb question but what is FSF?
----- Original Message -----
From: “Dejan Maksimovic”
> To: “File Systems Developers”
> Sent: Saturday, October 20, 2001 11:02 AM
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> > > I also encountered the next unexpected behaviour on NT4 SP6. FS driver’s
> > > IRP_MJ_CLOSE dispatch routine often returns impossible status code (high
> > > order byte is set to 0xF which means that the reserved bit is 1) though
> > > Irp->IoStatus.Status is fine.
> >
> > I have found this to happen sometimes, but I think it is related to
> FSF
> > corrupting some memory.
> >
> > > When can I return STATUS_PENDING from my FSFD?
> >
> > Anytime you want, virtually.
> >
> > > And why Microsoft states that FSFDs should not return STATUS_PENDING?
> >
> > For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many filters
> or FSD
> > might need the original process context - which if any FSFD returns
> > STATUS_PENDING will not be available, due to the processing being done in
> a
> > worker thread.
> >
> > > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to FSD
> and
> > > FSD in turn returns STATUS_PENDING too?
> >
> > If the FSFD is well written the result you want will happen. I.e. if
> the
> > FSFD handles STATUS_PENDING correctly, and pends correctly no problems
> will
> > occur.
> > It is quite possible for every FSFD in the chain and the FSD itself to
> > return STATUS_PENDING, and thus also get STATUS_PENDING from the device it
> > called.
> > What should you note: since you will call IoCallDriver from system
> worker
> > thread probably (you virtually said this above:-), if the IoCallDriver
> returns
> > STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> > completion routine gets called for that IRP.
> >
> > –
> > Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> > E-mail: xxxxx@alfasp.com
> > ICQ#: 56570367
> > Alfa File Monitor - File monitoring system for Win32 developers.
> > Alfa File Protector - File protection and hiding system for Win32
> developers.
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@alfasp.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Why return stat_pending? What is your code going to do (your thread)
while it is waiting for the create to complete? I do not think you can
used overlapped IO on create calls.
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, October 20, 2001 5:46 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
I’m working on FSFD for anti-virus program and I thought it would be a
good idea to return STATUS_PENDING before starting checking for virus.
You say FSD wants to be in original process context. Is it possible
after virus check return to the original process context? May be some
kind of APC?
And what about situation when IoCallDriver returns STATUS_PENDING but
IRP->PendingReturned is FALSE in completion routine?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:02 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I also encountered the next unexpected behaviour on NT4 SP6. FS
> > driver’s IRP_MJ_CLOSE dispatch routine often returns impossible
> > status code (high order byte is set to 0xF which means that the
> > reserved bit is 1) though
> > Irp->IoStatus.Status is fine.
>
> I have found this to happen sometimes, but I think it is related
> to
FSF
> corrupting some memory.
>
> > When can I return STATUS_PENDING from my FSFD?
>
> Anytime you want, virtually.
>
> > And why Microsoft states that FSFDs should not return
> > STATUS_PENDING?
>
> For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many
> filters
or FSD
> might need the original process context - which if any FSFD returns
> STATUS_PENDING will not be available, due to the processing being done
> in
a
> worker thread.
>
> > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to
> > FSD
and
> > FSD in turn returns STATUS_PENDING too?
>
> If the FSFD is well written the result you want will happen. I.e.
> if
the
> FSFD handles STATUS_PENDING correctly, and pends correctly no problems
will
> occur.
> It is quite possible for every FSFD in the chain and the FSD
> itself to return STATUS_PENDING, and thus also get STATUS_PENDING from
> the device it called.
> What should you note: since you will call IoCallDriver from system
worker
> thread probably (you virtually said this above:-), if the IoCallDriver
returns
> STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> completion routine gets called for that IRP.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Yes, it is dumb; file system filter
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, October 20, 2001 5:50 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
May be this is a dumb question but what is FSF?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:02 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I also encountered the next unexpected behaviour on NT4 SP6. FS
> > driver’s IRP_MJ_CLOSE dispatch routine often returns impossible
> > status code (high order byte is set to 0xF which means that the
> > reserved bit is 1) though
> > Irp->IoStatus.Status is fine.
>
> I have found this to happen sometimes, but I think it is related
> to
FSF
> corrupting some memory.
>
> > When can I return STATUS_PENDING from my FSFD?
>
> Anytime you want, virtually.
>
> > And why Microsoft states that FSFDs should not return
> > STATUS_PENDING?
>
> For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many
> filters
or FSD
> might need the original process context - which if any FSFD returns
> STATUS_PENDING will not be available, due to the processing being done
> in
a
> worker thread.
>
> > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to
> > FSD
and
> > FSD in turn returns STATUS_PENDING too?
>
> If the FSFD is well written the result you want will happen. I.e.
> if
the
> FSFD handles STATUS_PENDING correctly, and pends correctly no problems
will
> occur.
> It is quite possible for every FSFD in the chain and the FSD
> itself to return STATUS_PENDING, and thus also get STATUS_PENDING from
> the device it called.
> What should you note: since you will call IoCallDriver from system
worker
> thread probably (you virtually said this above:-), if the IoCallDriver
returns
> STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> completion routine gets called for that IRP.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I was joking. I forgot the 
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jamey Kirby
Sent: Saturday, October 20, 2001 8:38 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
Yes, it is dumb; file system filter
Jamey
xxxxx@storagecraft.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
Sent: Saturday, October 20, 2001 5:50 AM
To: File Systems Developers
Subject: [ntfsd] Re: STATUS_PENDING from FSD
May be this is a dumb question but what is FSF?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:02 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I also encountered the next unexpected behaviour on NT4 SP6. FS
> > driver’s IRP_MJ_CLOSE dispatch routine often returns impossible
> > status code (high order byte is set to 0xF which means that the
> > reserved bit is 1) though
> > Irp->IoStatus.Status is fine.
>
> I have found this to happen sometimes, but I think it is related
> to
FSF
> corrupting some memory.
>
> > When can I return STATUS_PENDING from my FSFD?
>
> Anytime you want, virtually.
>
> > And why Microsoft states that FSFDs should not return
> > STATUS_PENDING?
>
> For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many
> filters
or FSD
> might need the original process context - which if any FSFD returns
> STATUS_PENDING will not be available, due to the processing being done
> in
a
> worker thread.
>
> > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to
> > FSD
and
> > FSD in turn returns STATUS_PENDING too?
>
> If the FSFD is well written the result you want will happen. I.e.
> if
the
> FSFD handles STATUS_PENDING correctly, and pends correctly no problems
will
> occur.
> It is quite possible for every FSFD in the chain and the FSD
> itself to return STATUS_PENDING, and thus also get STATUS_PENDING from
> the device it called.
> What should you note: since you will call IoCallDriver from system
worker
> thread probably (you virtually said this above:-), if the IoCallDriver
returns
> STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
> completion routine gets called for that IRP.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> If I understand correctly, you want to:
- return STATUS_PENDING in IRP_MJ_CREATE dispatch
- return STATUS_MORE_PROCESSING_REQUIRED in completion
- call IoCallDriver in a worker thread initiated by the completion
routine
- do IoCompleteRequest in the worker thread.
May be we misunderstodd each other, may be not. I was planning to do it this
way:
- mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE dispatch.
But I do not need completion routine as far as I don’t care about result.
- start virus check.
- if checking is not successful return STATUS_ACCESS_DENIED and complete
request (do I have to do any additional cleanup?).
- when checking is finished call lower device using IoCallDriver.
- as far as I understand lower device will complete the request.
Am I missing something?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 4:05 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> > I’m working on FSFD for anti-virus program and I thought it would be a
good
> > idea to return STATUS_PENDING before starting checking for virus. You
say FSD
> > wants to be in original process context. Is it possible after virus
> > check return to the original process context? May be some kind of APC?
>
> You can, but that’s bad.
> The thing is, in IRP_MJ_CREATE you CAN return STATUS_PENDING, but you
should
> call IoCallDriver in Dispatch NOT in a worker thread.
> Nothing says you can’t or that it won’t work.
> The only reason why it might fail and cause a crash is if a Filter in
the
> chain doesn’t support STATUS_PENDING return, which isn’t your problem!
>
> > And what about situation when IoCallDriver returns STATUS_PENDING but
> > IRP->PendingReturned is FALSE in completion routine?
>
> I think that one is for Hector from NT Insider.
> Frankly, I don’t see a problem.
> If I understand correctly, you want to:
> - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> - return STATUS_MORE_PROCESSING_REQUIRED in completion
> - call IoCallDriver in a worker thread initiated by the completion
routine
> - do IoCompleteRequest in the worker thread.
> That’s quite OK.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
From your description, there’s no need to pend the IRP in the CREATE
dispatch.
Do the check in the dispatch itself.
Regards, Dejan.
Alexey Logachyov wrote:
> If I understand correctly, you want to:
> - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> - return STATUS_MORE_PROCESSING_REQUIRED in completion
> - call IoCallDriver in a worker thread initiated by the completion
routine
> - do IoCompleteRequest in the worker thread.
May be we misunderstodd each other, may be not. I was planning to do it this
way:
- mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE dispatch.
But I do not need completion routine as far as I don’t care about result.
- start virus check.
- if checking is not successful return STATUS_ACCESS_DENIED and complete
request (do I have to do any additional cleanup?).
- when checking is finished call lower device using IoCallDriver.
- as far as I understand lower device will complete the request.
Am I missing something?
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32
developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Sometimes virus checking takes a very long time, especialy when we have to
ask user what action to perform with infected file. Does it hurt to hold an
IRP processing for such a long time? Jamey says overlapped IO is impossible
on create calls. But does that mean that that I can just freeze until file
is checked.
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:38 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> From your description, there’s no need to pend the IRP in the CREATE
> dispatch.
> Do the check in the dispatch itself.
>
> Regards, Dejan.
>
> Alexey Logachyov wrote:
>
> > > If I understand correctly, you want to:
> > > - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> > > - return STATUS_MORE_PROCESSING_REQUIRED in completion
> > > - call IoCallDriver in a worker thread initiated by the completion
> > routine
> > > - do IoCompleteRequest in the worker thread.
> > May be we misunderstodd each other, may be not. I was planning to do it
this
> > way:
> > - mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE
dispatch.
> > But I do not need completion routine as far as I don’t care about
result.
> > - start virus check.
> > - if checking is not successful return STATUS_ACCESS_DENIED and
complete
> > request (do I have to do any additional cleanup?).
> > - when checking is finished call lower device using IoCallDriver.
> > - as far as I understand lower device will complete the request.
> >
> > Am I missing something?
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
> developers.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
That’s OK. But try to hold on your emotions next time.
----- Original Message -----
From: “Jamey Kirby”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 7:21 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
> I was joking. I forgot the
>
>
> Jamey
> xxxxx@storagecraft.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Jamey Kirby
> Sent: Saturday, October 20, 2001 8:38 AM
> To: File Systems Developers
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> Yes, it is dumb; file system filter
>
>
> Jamey
> xxxxx@storagecraft.com
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Alexey Logachyov
> Sent: Saturday, October 20, 2001 5:50 AM
> To: File Systems Developers
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> May be this is a dumb question but what is FSF?
>
> ----- Original Message -----
> From: “Dejan Maksimovic”
> To: “File Systems Developers”
> Sent: Saturday, October 20, 2001 11:02 AM
> Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
>
> > > I also encountered the next unexpected behaviour on NT4 SP6. FS
> > > driver’s IRP_MJ_CLOSE dispatch routine often returns impossible
> > > status code (high order byte is set to 0xF which means that the
> > > reserved bit is 1) though
> > > Irp->IoStatus.Status is fine.
> >
> > I have found this to happen sometimes, but I think it is related
> > to
> FSF
> > corrupting some memory.
> >
> > > When can I return STATUS_PENDING from my FSFD?
> >
> > Anytime you want, virtually.
> >
> > > And why Microsoft states that FSFDs should not return
> > > STATUS_PENDING?
> >
> > For IRP_MJ_CREATE only. That’s because in IRP_MJ_CREATE many
> > filters
> or FSD
> > might need the original process context - which if any FSFD returns
> > STATUS_PENDING will not be available, due to the processing being done
>
> > in
> a
> > worker thread.
> >
> > > What’s gonna happen if FSFD returns STATUS_PENDING then pass IRP to
> > > FSD
> and
> > > FSD in turn returns STATUS_PENDING too?
> >
> > If the FSFD is well written the result you want will happen. I.e.
> > if
> the
> > FSFD handles STATUS_PENDING correctly, and pends correctly no problems
> will
> > occur.
> > It is quite possible for every FSFD in the chain and the FSD
> > itself to return STATUS_PENDING, and thus also get STATUS_PENDING from
>
> > the device it called.
> > What should you note: since you will call IoCallDriver from system
> worker
> > thread probably (you virtually said this above:-), if the IoCallDriver
> returns
> > STATUS_PENDING, make sure you don’t call IoCompleteRequest before your
>
> > completion routine gets called for that IRP.
> >
> > –
> > Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> > E-mail: xxxxx@alfasp.com
> > ICQ#: 56570367
> > Alfa File Monitor - File monitoring system for Win32 developers. Alfa
> > File Protector - File protection and hiding system for Win32
> developers.
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com To
> unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
If virus check failed I put STATUS_ACCESS_DENIED to Irp->IoStatus.Status and
complete the request. Do I have to do any additional cleanup? Who destroys
the FILE_OBJECT?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Saturday, October 20, 2001 11:38 PM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> From your description, there’s no need to pend the IRP in the CREATE
> dispatch.
> Do the check in the dispatch itself.
>
> Regards, Dejan.
>
> Alexey Logachyov wrote:
>
> > > If I understand correctly, you want to:
> > > - return STATUS_PENDING in IRP_MJ_CREATE dispatch
> > > - return STATUS_MORE_PROCESSING_REQUIRED in completion
> > > - call IoCallDriver in a worker thread initiated by the completion
> > routine
> > > - do IoCompleteRequest in the worker thread.
> > May be we misunderstodd each other, may be not. I was planning to do it
this
> > way:
> > - mark IRP pending and return STATUS_PENDING in IRP_MJ_CREATE
dispatch.
> > But I do not need completion routine as far as I don’t care about
result.
> > - start virus check.
> > - if checking is not successful return STATUS_ACCESS_DENIED and
complete
> > request (do I have to do any additional cleanup?).
> > - when checking is finished call lower device using IoCallDriver.
> > - as far as I understand lower device will complete the request.
> >
> > Am I missing something?
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
> developers.
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
I suggest not waiting, but it won’t be problematic.
Last I checked, NAV and McAffee don’t have an option to ask the user under
NT systems, so I guess it’s needless to implement it.
Regards, Dejan.
Alexey Logachyov wrote:
Sometimes virus checking takes a very long time, especialy when we have to
ask user what action to perform with infected file. Does it hurt to hold an
IRP processing for such a long time? Jamey says overlapped IO is impossible on
create calls. But does that mean that that I can just freeze until file is
checked.
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
Our program had this option for all years of its existance. And I’m sure
that nobody will agree to disable this feature. If it was a new product I
could say that it’s impossible to wait for user’s decision. But everybody
knows that it is possible. Everything I can do is to put a statement like
‘This is not recommended to enable this feature’ in help file.
Anyway checking takes a long time pretty often especialy in case when we
have to cure a file with two or more viruses.
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Sunday, October 21, 2001 1:48 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> I suggest not waiting, but it won’t be problematic.
> Last I checked, NAV and McAffee don’t have an option to ask the user
under
> NT systems, so I guess it’s needless to implement it.
>
> Regards, Dejan.
>
> Alexey Logachyov wrote:
>
> > Sometimes virus checking takes a very long time, especialy when we have
to
> > ask user what action to perform with infected file. Does it hurt to hold
an
> > IRP processing for such a long time? Jamey says overlapped IO is
impossible on
> > create calls. But does that mean that that I can just freeze until file
is
> > checked.
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
IRP_MJ_CLOSE requests to do this.
Regards, Dejan.
If virus check failed I put STATUS_ACCESS_DENIED to Irp->IoStatus.Status and
complete the request. Do I have to do any additional cleanup? Who destroys the
FILE_OBJECT?
–
Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
E-mail: xxxxx@alfasp.com
ICQ#: 56570367
Alfa File Monitor - File monitoring system for Win32 developers.
Alfa File Protector - File protection and hiding system for Win32 developers.
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
So, does this mean that FSD destroys FILE_OBJECT?
How can we send IRP_MJ_CLEANUP/CLOSE if the FSD have never seen
IRP_MJ_CREATE (we scan for viruses before pass the IRP down)?
----- Original Message -----
From: “Dejan Maksimovic”
To: “File Systems Developers”
Sent: Sunday, October 21, 2001 2:50 AM
Subject: [ntfsd] Re: STATUS_PENDING from FSD
>
> You must do the cleanup of the file object. Send IRP_MJ_CLEANUP then
> IRP_MJ_CLOSE requests to do this.
>
> Regards, Dejan.
>
> > If virus check failed I put STATUS_ACCESS_DENIED to Irp->IoStatus.Status
and
> > complete the request. Do I have to do any additional cleanup? Who
destroys the
> > FILE_OBJECT?
>
> –
> Kind regards, Dejan M. CEO Alfa Co. www.alfasp.com
> E-mail: xxxxx@alfasp.com
> ICQ#: 56570367
> Alfa File Monitor - File monitoring system for Win32 developers.
> Alfa File Protector - File protection and hiding system for Win32
developers.
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com