the process that execute a minifilter

hi, everyone.
i am new to the field of windows internals. i want to do some programming on
minifilters. i have some questions:

  1. what’s the name of the process that executes the minifilter, csrss.exe,
    lsass.exe, smss.exe, or svchose.exe?

  2. i write a minifilter, e.g. filterA, and then if i don’t create other new
    threads in my code, how many threads are there that would execute my
    filterA’s code?

  3. based on the points above, i want to know in what kind of conditions i
    should use locks to protect the datas belonging to my filterA itself?

thanks in advance.

> 1. what’s the name of the process that executes the minifilter, csrss.exe,

lsass.exe, smss.exe, or svchose.exe?

No processes, everything is in kernel.

  1. i write a minifilter, e.g. filterA, and then if i don’t create other new
    threads in my code, how many threads are there that would execute my
    filterA’s code?

The pool of worker threads in the kernel. The exact number is not defined and
is dynamic.

Also all app’s threads opening files on the filtered volume.

  1. based on the points above, i want to know in what kind of conditions i
    should use locks to protect the datas belonging to my filterA itself?

Do you have any experience with any multithreading code?


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

em, i mean if there is only one thread but not multiple threads executing my
filter’s code, of course, i don’t create new threads in the filter, i don’t
need to use locks to protect the data of the filter itself. factually,
minifilter samples provided in ddk use few locks other than in some specific
conditions in which ones the samples need to interact with memory addresses
provided by user-mode or other kernel-mode components.
of course i know it necessary to use locks to protect contexts during
multithreading. so i want to be sure whether the minifilter works under
multithreading if i don’t create other new threads in the filter itself.
On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih
wrote:

> > 1. what’s the name of the process that executes the minifilter,
> csrss.exe,
> > lsass.exe, smss.exe, or svchose.exe?
>
> No processes, everything is in kernel.
>
> > 2. i write a minifilter, e.g. filterA, and then if i don’t create other
> new
> > threads in my code, how many threads are there that would execute my
> > filterA’s code?
>
> The pool of worker threads in the kernel. The exact number is not defined
> and
> is dynamic.
>
> Also all app’s threads opening files on the filtered volume.
>
> > 3. based on the points above, i want to know in what kind of conditions i
> > should use locks to protect the datas belonging to my filterA itself?
>
> Do you have any experience with any multithreading code?
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

Hi Lu,

You seem to be very new to the file systems domain. Please read up some
material on it (Rajeev nagar, etc.)

The minifilter callbacks can be called in context of multiple threads. So
even though you are not creating any new threads, still your code should be
prepared to operate in a multi-threaded environment.

Regards,

Ayush Gupta

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of lu zhao
Sent: Thursday, May 15, 2008 11:23 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] the process that execute a minifilter

em, i mean if there is only one thread but not multiple threads executing my
filter’s code, of course, i don’t create new threads in the filter, i don’t
need to use locks to protect the data of the filter itself. factually,
minifilter samples provided in ddk use few locks other than in some specific
conditions in which ones the samples need to interact with memory addresses
provided by user-mode or other kernel-mode components.

of course i know it necessary to use locks to protect contexts during
multithreading. so i want to be sure whether the minifilter works under
multithreading if i don’t create other new threads in the filter itself.

On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih
wrote:

> 1. what’s the name of the process that executes the minifilter, csrss.exe,
> lsass.exe, smss.exe, or svchose.exe?

No processes, everything is in kernel.

> 2. i write a minifilter, e.g. filterA, and then if i don’t create other
new
> threads in my code, how many threads are there that would execute my
> filterA’s code?

The pool of worker threads in the kernel. The exact number is not defined
and
is dynamic.

Also all app’s threads opening files on the filtered volume.

> 3. based on the points above, i want to know in what kind of conditions i
> should use locks to protect the datas belonging to my filterA itself?

Do you have any experience with any multithreading code?


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com http:</http:>


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

— NTFSD is sponsored by OSR For our schedule debugging and file system
seminars (including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars You are currently subscribed to ntfsd as:
xxxxx@yahoo.co.in To unsubscribe send a blank email to
xxxxx@lists.osr.com

thanks to Maxim S applying so soon. : )
however, i need to know more~

On Thu, May 15, 2008 at 1:52 PM, lu zhao wrote:

> em, i mean if there is only one thread but not multiple threads executing
> my filter’s code, of course, i don’t create new threads in the filter, i
> don’t need to use locks to protect the data of the filter itself. factually,
> minifilter samples provided in ddk use few locks other than in some specific
> conditions in which ones the samples need to interact with memory addresses
> provided by user-mode or other kernel-mode components.
> of course i know it necessary to use locks to protect contexts during
> multithreading. so i want to be sure whether the minifilter works under
> multithreading if i don’t create other new threads in the filter itself.
> On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih <
> xxxxx@storagecraft.com> wrote:
>
>> > 1. what’s the name of the process that executes the minifilter,
>> csrss.exe,
>> > lsass.exe, smss.exe, or svchose.exe?
>>
>> No processes, everything is in kernel.
>>
>> > 2. i write a minifilter, e.g. filterA, and then if i don’t create other
>> new
>> > threads in my code, how many threads are there that would execute my
>> > filterA’s code?
>>
>> The pool of worker threads in the kernel. The exact number is not defined
>> and
>> is dynamic.
>>
>> Also all app’s threads opening files on the filtered volume.
>>
>> > 3. based on the points above, i want to know in what kind of conditions
>> i
>> > should use locks to protect the datas belonging to my filterA itself?
>>
>> Do you have any experience with any multithreading code?
>>
>> –
>> Maxim Shatskih, Windows DDK MVP
>> StorageCraft Corporation
>> xxxxx@storagecraft.com
>> http://www.storagecraft.com
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@gmail.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>

yeah, i only know one book, windows nt file system internals, and i am
confused by some contents of the book. can anyone introduce other materials?

thanks in advance.

On Thu, May 15, 2008 at 2:08 PM, Ayush Gupta wrote:

> Hi Lu,
>
>
>
> You seem to be very new to the file systems domain. Please read up some
> material on it (Rajeev nagar, etc.)
>
> The minifilter callbacks can be called in context of multiple threads. So
> even though you are not creating any new threads, still your code should be
> prepared to operate in a multi-threaded environment.
>
>
>
> Regards,
>
> Ayush Gupta
>
>
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *lu zhao
> Sent: Thursday, May 15, 2008 11:23 AM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] the process that execute a minifilter
>
>
>
> em, i mean if there is only one thread but not multiple threads executing
> my filter’s code, of course, i don’t create new threads in the filter, i
> don’t need to use locks to protect the data of the filter itself. factually,
> minifilter samples provided in ddk use few locks other than in some specific
> conditions in which ones the samples need to interact with memory addresses
> provided by user-mode or other kernel-mode components.
>
> of course i know it necessary to use locks to protect contexts during
> multithreading. so i want to be sure whether the minifilter works under
> multithreading if i don’t create other new threads in the filter itself.
>
> On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih <
> xxxxx@storagecraft.com> wrote:
>
> > 1. what’s the name of the process that executes the minifilter,
> csrss.exe,
> > lsass.exe, smss.exe, or svchose.exe?
>
> No processes, everything is in kernel.
>
>
> > 2. i write a minifilter, e.g. filterA, and then if i don’t create other
> new
> > threads in my code, how many threads are there that would execute my
> > filterA’s code?
>
> The pool of worker threads in the kernel. The exact number is not defined
> and
> is dynamic.
>
> Also all app’s threads opening files on the filtered volume.
>
>
> > 3. based on the points above, i want to know in what kind of conditions i
> > should use locks to protect the datas belonging to my filterA itself?
>
> Do you have any experience with any multithreading code?
>
> –
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@gmail.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> — NTFSD is sponsored by OSR For our schedule debugging and file system
> seminars (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars You are currently subscribed to ntfsd as:
> xxxxx@yahoo.co.in To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

That is the ONLY book on this subject. OSR offers classes in this subject. You can see when the next one takes place on their web site. The only other materials on file systems and file systems filters is contained in the WDK.
“lu zhao” wrote in message news:xxxxx@ntfsd…
yeah, i only know one book, windows nt file system internals, and i am confused by some contents of the book. can anyone introduce other materials?

thanks in advance.

On Thu, May 15, 2008 at 2:08 PM, Ayush Gupta wrote:

Hi Lu,

You seem to be very new to the file systems domain. Please read up some material on it (Rajeev nagar, etc.)

The minifilter callbacks can be called in context of multiple threads. So even though you are not creating any new threads, still your code should be prepared to operate in a multi-threaded environment.

Regards,

Ayush Gupta

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of lu zhao
Sent: Thursday, May 15, 2008 11:23 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] the process that execute a minifilter

em, i mean if there is only one thread but not multiple threads executing my filter’s code, of course, i don’t create new threads in the filter, i don’t need to use locks to protect the data of the filter itself. factually, minifilter samples provided in ddk use few locks other than in some specific conditions in which ones the samples need to interact with memory addresses provided by user-mode or other kernel-mode components.

of course i know it necessary to use locks to protect contexts during multithreading. so i want to be sure whether the minifilter works under multithreading if i don’t create other new threads in the filter itself.

On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih wrote:

> 1. what’s the name of the process that executes the minifilter, csrss.exe,
> lsass.exe, smss.exe, or svchose.exe?

No processes, everything is in kernel.

> 2. i write a minifilter, e.g. filterA, and then if i don’t create other new
> threads in my code, how many threads are there that would execute my
> filterA’s code?

The pool of worker threads in the kernel. The exact number is not defined and
is dynamic.

Also all app’s threads opening files on the filtered volume.

> 3. based on the points above, i want to know in what kind of conditions i
> should use locks to protect the datas belonging to my filterA itself?

Do you have any experience with any multithreading code?


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

— NTFSD is sponsored by OSR For our schedule debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in To unsubscribe send a blank email to xxxxx@lists.osr.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

so, if i define a global variable, initiate it in the instance-setup
callback and then change its value later in pre. or post. routines, i should
allocate locks to it. am i right?

On Thu, May 15, 2008 at 2:30 PM, David Craig wrote:

> That is the ONLY book on this subject. OSR offers classes in this
> subject. You can see when the next one takes place on their web site. The
> only other materials on file systems and file systems filters is contained
> in the WDK.
>
> “lu zhao” wrote in message news:xxxxx@ntfsd…
> yeah, i only know one book, windows nt file system internals, and i am
> confused by some contents of the book. can anyone introduce other materials?
>
> thanks in advance.
>
> On Thu, May 15, 2008 at 2:08 PM, Ayush Gupta
> wrote:
>
>> Hi Lu,
>>
>>
>>
>> You seem to be very new to the file systems domain. Please read up some
>> material on it (Rajeev nagar, etc.)
>>
>> The minifilter callbacks can be called in context of multiple threads. So
>> even though you are not creating any new threads, still your code should be
>> prepared to operate in a multi-threaded environment.
>>
>>
>>
>> Regards,
>>
>> Ayush Gupta
>>
>>
>>
>> From: xxxxx@lists.osr.com [mailto:
>> xxxxx@lists.osr.com] *On Behalf Of *lu zhao
>> Sent: Thursday, May 15, 2008 11:23 AM
>> To: Windows File Systems Devs Interest List
>> Subject: Re: [ntfsd] the process that execute a minifilter
>>
>>
>>
>> em, i mean if there is only one thread but not multiple threads executing
>> my filter’s code, of course, i don’t create new threads in the filter, i
>> don’t need to use locks to protect the data of the filter itself. factually,
>> minifilter samples provided in ddk use few locks other than in some specific
>> conditions in which ones the samples need to interact with memory addresses
>> provided by user-mode or other kernel-mode components.
>>
>> of course i know it necessary to use locks to protect contexts during
>> multithreading. so i want to be sure whether the minifilter works under
>> multithreading if i don’t create other new threads in the filter itself.
>>
>> On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih <
>> xxxxx@storagecraft.com> wrote:
>>
>> > 1. what’s the name of the process that executes the minifilter,
>> csrss.exe,
>> > lsass.exe, smss.exe, or svchose.exe?
>>
>> No processes, everything is in kernel.
>>
>>
>> > 2. i write a minifilter, e.g. filterA, and then if i don’t create other
>> new
>> > threads in my code, how many threads are there that would execute my
>> > filterA’s code?
>>
>> The pool of worker threads in the kernel. The exact number is not defined
>> and
>> is dynamic.
>>
>> Also all app’s threads opening files on the filtered volume.
>>
>>
>> > 3. based on the points above, i want to know in what kind of conditions
>> i
>> > should use locks to protect the datas belonging to my filterA itself?
>>
>> Do you have any experience with any multithreading code?
>>
>> –
>> Maxim Shatskih, Windows DDK MVP
>> StorageCraft Corporation
>> xxxxx@storagecraft.com
>> http://www.storagecraft.com
>>
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: xxxxx@gmail.com
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>>
>> — NTFSD is sponsored by OSR For our schedule debugging and file system
>> seminars (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars You are currently subscribed to ntfsd as:
>> xxxxx@yahoo.co.in To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule debugging and file system seminars
>> (including our new fs mini-filter seminar) visit:
>> http://www.osr.com/seminars
>>
>> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
>>
>> To unsubscribe send a blank email to xxxxx@lists.osr.com
>>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

Start over with a few computer courses at a good university. There is no way anyone can give you the years of experience you need to understand the concepts. You need to learn the basics with the first how to learn about computers. There are major differences between writing code in user mode where the system only gives you one thing to do at a time unless you write multithreaded code. Think about a spreadsheet where one thread will service user inputs and another thread will perform recomputation of cells. The is very simple as both threads are very lightly connected. Only during an actual update of a cell does that cell have to be ‘locked’ to prevent the recomputation thread from accessing it.

In a program such as Adobe Premier where a file is being converted from one format to another. How do you get multiple threads running on multiple processors to each work on a piece of the problem without having too much thrashing or now allowing the pieces to come together without artifact or loss of continuity? How about SETI where volunteers allow their computers to work on unconnected pieces - from the individual computers’ perspective? How can you use multiple processors to do stream encryption where each block depends upon all previous blocks?

Luckily the last item about encryption does not resemble any tasks required of file system filters, but compressed files in NTFS are similar. Even then, each file is compressed independently and not as a group.
“lu zhao” wrote in message news:xxxxx@ntfsd…
so, if i define a global variable, initiate it in the instance-setup callback and then change its value later in pre. or post. routines, i should allocate locks to it. am i right?

On Thu, May 15, 2008 at 2:30 PM, David Craig wrote:

That is the ONLY book on this subject. OSR offers classes in this subject. You can see when the next one takes place on their web site. The only other materials on file systems and file systems filters is contained in the WDK.
“lu zhao” wrote in message news:xxxxx@ntfsd…
yeah, i only know one book, windows nt file system internals, and i am confused by some contents of the book. can anyone introduce other materials?

thanks in advance.

On Thu, May 15, 2008 at 2:08 PM, Ayush Gupta wrote:

Hi Lu,

You seem to be very new to the file systems domain. Please read up some material on it (Rajeev nagar, etc.)

The minifilter callbacks can be called in context of multiple threads. So even though you are not creating any new threads, still your code should be prepared to operate in a multi-threaded environment.

Regards,

Ayush Gupta

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of lu zhao
Sent: Thursday, May 15, 2008 11:23 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] the process that execute a minifilter

em, i mean if there is only one thread but not multiple threads executing my filter’s code, of course, i don’t create new threads in the filter, i don’t need to use locks to protect the data of the filter itself. factually, minifilter samples provided in ddk use few locks other than in some specific conditions in which ones the samples need to interact with memory addresses provided by user-mode or other kernel-mode components.

of course i know it necessary to use locks to protect contexts during multithreading. so i want to be sure whether the minifilter works under multithreading if i don’t create other new threads in the filter itself.

On Thu, May 15, 2008 at 12:00 PM, Maxim S. Shatskih wrote:

> 1. what’s the name of the process that executes the minifilter, csrss.exe,
> lsass.exe, smss.exe, or svchose.exe?

No processes, everything is in kernel.

> 2. i write a minifilter, e.g. filterA, and then if i don’t create other new
> threads in my code, how many threads are there that would execute my
> filterA’s code?

The pool of worker threads in the kernel. The exact number is not defined and
is dynamic.

Also all app’s threads opening files on the filtered volume.

> 3. based on the points above, i want to know in what kind of conditions i
> should use locks to protect the datas belonging to my filterA itself?

Do you have any experience with any multithreading code?


Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

— NTFSD is sponsored by OSR For our schedule debugging and file system seminars (including our new fs mini-filter seminar) visit: http://www.osr.com/seminars You are currently subscribed to ntfsd as: xxxxx@yahoo.co.in To unsubscribe send a blank email to xxxxx@lists.osr.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’

To unsubscribe send a blank email to xxxxx@lists.osr.com