Use MmMapViewOfSection to write,I can't hook the Paging Write!

In my filter,I will Add a tail to file in IRP_MJ_CLEANUP.
I SetFileSize(original file size+tail size) succeed,and then
I MmCreateSection succeed,and MmMapViewOfSection succeed too.
So,I use the pointer(the view+some offset) to write.I write some data to the view.
and then,I MmUnmapViewOfSection.
It can work in some machine,but it can’t work in other machine!
In the machine can work,these work will trigger a paging write.But in the machine can’t work,these work can’t trigger a Paging Write!At least,I can’t see the Paging Write in my filter.

So,after these work.the following Paging write will send a buffer without my data(it’s all 0 in the position my data should occurs).
And because I have SetFileSize ,so the tail is all 0!
Anybody can explain it?

And if these can’t work,I want to roll my paging IO to do the same work.
But my question is:
If I roll my paging write directly,will it disturb(or bypass) the Memory Manager(or Cache Manager).
If it will disturb the Mm,I roll my paging write to write some data,and Memory manager(or Cache Manager)don’t know it.Assume that a Memory Map file,and the Application write the data,because the Mm don’t know my tail,it send a Paging write with all 0 in my data should occurs,Error!
What Should I do?

Hi,

At least,I can’t see the Paging Write in my filter.

When the Memory Manager’s Mapped Page Writer thread writers modified pages
it uses the FO which backs the section which may not be the same for which
you modify IRP_MJ_CLEANUP.
MmMapViewOfSection maps the file in the user’s space, so the user process
may change your data.


Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> In my filter,I will Add a tail to file in IRP_MJ_CLEANUP.
> I SetFileSize(original file size+tail size) succeed,and then
> I MmCreateSection succeed,and MmMapViewOfSection succeed too.
> So,I use the pointer(the view+some offset) to write.I write some data to
> the view.
> and then,I MmUnmapViewOfSection.
> It can work in some machine,but it can’t work in other machine!
> In the machine can work,these work will trigger a paging write.But in the
> machine can’t work,these work can’t trigger a Paging Write!At least,I
> can’t see the Paging Write in my filter.
>
> So,after these work.the following Paging write will send a buffer without
> my data(it’s all 0 in the position my data should occurs).
> And because I have SetFileSize ,so the tail is all 0!
> Anybody can explain it?
>
> And if these can’t work,I want to roll my paging IO to do the same work.
> But my question is:
> If I roll my paging write directly,will it disturb(or bypass) the Memory
> Manager(or Cache Manager).
> If it will disturb the Mm,I roll my paging write to write some data,and
> Memory manager(or Cache Manager)don’t know it.Assume that a Memory Map
> file,and the Application write the data,because the Mm don’t know my
> tail,it send a Paging write with all 0 in my data should occurs,Error!
> What Should I do?
>

in my filter,I should see the Paging write.
because I trace all FO and the FCB they pointed.
the FO which backs the section is no problem,my filter works fine for it.

yes,I have tested it.
If I roll my IRP for paging ,the cache manager don’t know it.
So,if the App (ex,notepad.exe) use the memory map file to write,it will send a paging write.But now,the cache manager don’t know the data in the file is not 0(because my roll my IRP for paging write to add a tail),so the cache manager don’t send a paging read to retrieve the data again.the cache manager will send a paging write,and the data is real data(notepad.exe want to write) and others is 0(but these 0 should be my tail data).
So,these 0 will overwrite my tail!

It’s strange!even if I use MmCreateSection and MmMapViewOfSection,the above still occurs.
But in my opinion,I use MmMapViewOfSection should notify the cache manager about my data,the cache manager should know my data have writed to the file tail.
But when notepad.exe save the file, the cache manager still send a paging write,and the data is real data(notepad.exe want to write) and others is 0(but these 0 should be my tail data).
So,these 0 will overwrite my tail!

What should I do?thanks for any suggestion.

And a important thing:
if I use MmCreateSection and MmMapViewOfSection,in some system,the cache manager will send the Paging Write with my data!But in some system,the cache manager will send the Paging write with 0(not my data,but should be my data).

Consider the following sequence

  1. Your filter receives IRP_MJ_CLEANUP, the file size is OriginalSize
  2. You change the file size by adding the TailSize, the FSD calls
    CcSetFileSize.
  3. You map the file and write data in the pages, the system does not write
    pages to disk.
  4. You press the Save button in the application
  5. The applications compute the new file size which is smaller than (
    OriginalSize + TailSize ) and send request to the FSD.
  6. The FSD calls CcSetFileSize and the Memory Manager changes the section
    size and purges the pages which are beyond the end of the file, it can do
    this if the file is only cached and not mapped by any application.
  7. The memory manager flush the pages which span the new file size. You do
    not see you tail because the system purges pages which contain it.


Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> In my filter,I will Add a tail to file in IRP_MJ_CLEANUP.
> I SetFileSize(original file size+tail size) succeed,and then
> I MmCreateSection succeed,and MmMapViewOfSection succeed too.
> So,I use the pointer(the view+some offset) to write.I write some data to
> the view.
> and then,I MmUnmapViewOfSection.
> It can work in some machine,but it can’t work in other machine!
> In the machine can work,these work will trigger a paging write.But in the
> machine can’t work,these work can’t trigger a Paging Write!At least,I
> can’t see the Paging Write in my filter.
>
> So,after these work.the following Paging write will send a buffer without
> my data(it’s all 0 in the position my data should occurs).
> And because I have SetFileSize ,so the tail is all 0!
> Anybody can explain it?
>
> And if these can’t work,I want to roll my paging IO to do the same work.
> But my question is:
> If I roll my paging write directly,will it disturb(or bypass) the Memory
> Manager(or Cache Manager).
> If it will disturb the Mm,I roll my paging write to write some data,and
> Memory manager(or Cache Manager)don’t know it.Assume that a Memory Map
> file,and the Application write the data,because the Mm don’t know my
> tail,it send a Paging write with all 0 in my data should occurs,Error!
> What Should I do?
>

In addition, if the file is cached and mapped by some user’s process the
CcSetFileSizes will succeed in zeroing the data in the new last page from
the new file end to the page end but fail the purging of the pages beyound
this new last page.


Slava Imameyev, xxxxx@hotmail.com

“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
> Consider the following sequence
> 1) Your filter receives IRP_MJ_CLEANUP, the file size is OriginalSize
> 2) You change the file size by adding the TailSize, the FSD calls
> CcSetFileSize.
> 3) You map the file and write data in the pages, the system does not write
> pages to disk.
> 4) You press the Save button in the application
> 5) The applications compute the new file size which is smaller than (
> OriginalSize + TailSize ) and send request to the FSD.
> 6) The FSD calls CcSetFileSize and the Memory Manager changes the section
> size and purges the pages which are beyond the end of the file, it can do
> this if the file is only cached and not mapped by any application.
> 7) The memory manager flush the pages which span the new file size. You do
> not see you tail because the system purges pages which contain it.
>
> –
> Slava Imameyev, xxxxx@hotmail.com
>
>
> wrote in message news:xxxxx@ntfsd…
>> In my filter,I will Add a tail to file in IRP_MJ_CLEANUP.
>> I SetFileSize(original file size+tail size) succeed,and then
>> I MmCreateSection succeed,and MmMapViewOfSection succeed too.
>> So,I use the pointer(the view+some offset) to write.I write some data to
>> the view.
>> and then,I MmUnmapViewOfSection.
>> It can work in some machine,but it can’t work in other machine!
>> In the machine can work,these work will trigger a paging write.But in the
>> machine can’t work,these work can’t trigger a Paging Write!At least,I
>> can’t see the Paging Write in my filter.
>>
>> So,after these work.the following Paging write will send a buffer without
>> my data(it’s all 0 in the position my data should occurs).
>> And because I have SetFileSize ,so the tail is all 0!
>> Anybody can explain it?
>>
>> And if these can’t work,I want to roll my paging IO to do the same work.
>> But my question is:
>> If I roll my paging write directly,will it disturb(or bypass) the Memory
>> Manager(or Cache Manager).
>> If it will disturb the Mm,I roll my paging write to write some data,and
>> Memory manager(or Cache Manager)don’t know it.Assume that a Memory Map
>> file,and the Application write the data,because the Mm don’t know my
>> tail,it send a Paging write with all 0 in my data should occurs,Error!
>> What Should I do?
>>
>
>
>

no,the IRP_MJ_CLEANUP is for the last handle with write-access.
so,your descritpion:
5) The applications compute the new file size which is smaller than (
OriginalSize + TailSize ) and send request to the FSD.
didn’t occurs.

And,in my filter,in the same os(ex,xp sp2),some machine works ,some machine don’t works.