Where shall I read a file, in PreCreate or PostCreat?

NTFSD
1

Hello!

I will read a file in kernel mode, shall I do that in PreCreate or PostCreat and can I know the length of the file before I begin to read?

Allocation in PostCreate must be nonpaged pool memory and when I read about nonpeged pool allocations it says:
Nonpaged pool can be accessed from any IRQL, but it is a scarce resource and drivers should allocate it only when necessary.
Q1: Therefore I wonder shall I read the file in PreCreate and use paged pool instead?
When I read about paged pool it says:
Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
Q2: Can I know which IRQL the I/O operation has in Pre or Post Create?

Q3: When I read the file I must allocate enough buffer size, can I know the size of the file before I start to read it?

Regards
Mattias Bergkvist

2

If you are working with mini-filter, post-create is guaranteed in
PASSIVE_LEVEL.

wrote in message news:xxxxx@ntfsd…
> Hello!
>
> I will read a file in kernel mode, shall I do that in PreCreate or
> PostCreat and can I know the length of the file before I begin to read?
>
> Allocation in PostCreate must be nonpaged pool memory and when I read
> about nonpeged pool allocations it says:
> Nonpaged pool can be accessed from any IRQL, but it is a scarce resource
> and drivers should allocate it only when necessary.
> Q1: Therefore I wonder shall I read the file in PreCreate and use paged
> pool instead?
> When I read about paged pool it says:
> Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
> Q2: Can I know which IRQL the I/O operation has in Pre or Post Create?
>
> Q3: When I read the file I must allocate enough buffer size, can I know
> the size of the file before I start to read it?
>
> Regards
> Mattias Bergkvist
>
>

3

First, the easy question:

A3) FltQueryInformation will be able to get you the size of the file.

A2) Yes, you can use KeGetCurrentIrql. However, it’s not necessary in
the minifilter model - PostCreate runs at PASSIVE_LEVEL.

A1) You probably CAN’T read the file in PreCreate unless you
FltCreateFile and get a handle yourself. If it hasn’t gone down to the
FSD, the file object that’s the subject of the create won’t be usable
yet.

Ordinarily, if you need to do something at low IRQL in a post-op, you
need to setup a workitem, or call FltDoCompletionProcessingWhenSafe.
Because the create postop happens at PASSIVE_LEVEL, that’s not necessary
for what you’re trying to do.

All that said, if you’re planning to read the whole file into one
buffer, you’re going to have to account for the situation of having a
file larger than the amount of memory you can allocate from either the
Paged or NonPaged pool. If you just need to read the file one buffer at
a time, you should be able to do so without knowing the file size
beforehand.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netcleantech.com
Sent: Monday, January 21, 2008 10:04 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Where shall I read a file, in PreCreate or PostCreat?

Hello!

I will read a file in kernel mode, shall I do that in PreCreate or
PostCreat and can I know the length of the file before I begin to read?

Allocation in PostCreate must be nonpaged pool memory and when I read
about nonpeged pool allocations it says:
Nonpaged pool can be accessed from any IRQL, but it is a scarce resource
and drivers should allocate it only when necessary.
Q1: Therefore I wonder shall I read the file in PreCreate and use paged
pool instead?
When I read about paged pool it says:
Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
Q2: Can I know which IRQL the I/O operation has in Pre or Post Create?

Q3: When I read the file I must allocate enough buffer size, can I know
the size of the file before I start to read it?

Regards
Mattias Bergkvist

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

4

Hi,
A1: Sure, you can allocate from paged pool in pre-create.
A2: pre and postcreate callbacks are always called at PASSIVE_LEVEL
A3: Use FltQueryInformationFile to retrieve information about file

Jan

wrote in message news:xxxxx@ntfsd…
> Hello!
>
> I will read a file in kernel mode, shall I do that in PreCreate or
PostCreat and can I know the length of the file before I begin to read?
>
> Allocation in PostCreate must be nonpaged pool memory and when I read
about nonpeged pool allocations it says:
> Nonpaged pool can be accessed from any IRQL, but it is a scarce resource
and drivers should allocate it only when necessary.
> Q1: Therefore I wonder shall I read the file in PreCreate and use paged
pool instead?
> When I read about paged pool it says:
> Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
> Q2: Can I know which IRQL the I/O operation has in Pre or Post Create?
>
> Q3: When I read the file I must allocate enough buffer size, can I know
the size of the file before I start to read it?
>
> Regards
> Mattias Bergkvist
>
>

5

Ops,
I do not read Q1 properly. Like Eric wrote you will have to get your own
handle to file (you open it using filename which you get from
FltGetFileNameInformation) in precreate.
You can use file object in postcreate directly if status of operation is ok.

“Jan Milan” wrote in message news:xxxxx@ntfsd…
> Hi,
> A1: Sure, you can allocate from paged pool in pre-create.
> A2: pre and postcreate callbacks are always called at PASSIVE_LEVEL
> A3: Use FltQueryInformationFile to retrieve information about file
>
> Jan
>

6

>A2) Yes, you can use KeGetCurrentIrql. However, it’s not necessary in

the minifilter model - PostCreate runs at PASSIVE_LEVEL.

How do you know if it is not mini-filter model, “PostCreate runs at
PASSIVE_LEVEL”?

“Eric Diven” wrote in message news:xxxxx@ntfsd…
First, the easy question:

A3) FltQueryInformation will be able to get you the size of the file.

A2) Yes, you can use KeGetCurrentIrql. However, it’s not necessary in
the minifilter model - PostCreate runs at PASSIVE_LEVEL.

A1) You probably CAN’T read the file in PreCreate unless you
FltCreateFile and get a handle yourself. If it hasn’t gone down to the
FSD, the file object that’s the subject of the create won’t be usable
yet.

Ordinarily, if you need to do something at low IRQL in a post-op, you
need to setup a workitem, or call FltDoCompletionProcessingWhenSafe.
Because the create postop happens at PASSIVE_LEVEL, that’s not necessary
for what you’re trying to do.

All that said, if you’re planning to read the whole file into one
buffer, you’re going to have to account for the situation of having a
file larger than the amount of memory you can allocate from either the
Paged or NonPaged pool. If you just need to read the file one buffer at
a time, you should be able to do so without knowing the file size
beforehand.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@netcleantech.com
Sent: Monday, January 21, 2008 10:04 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Where shall I read a file, in PreCreate or PostCreat?

Hello!

I will read a file in kernel mode, shall I do that in PreCreate or
PostCreat and can I know the length of the file before I begin to read?

Allocation in PostCreate must be nonpaged pool memory and when I read
about nonpeged pool allocations it says:
Nonpaged pool can be accessed from any IRQL, but it is a scarce resource
and drivers should allocate it only when necessary.
Q1: Therefore I wonder shall I read the file in PreCreate and use paged
pool instead?
When I read about paged pool it says:
Paged pool can only be allocated and accessed at IRQL < DISPATCH_LEVEL.
Q2: Can I know which IRQL the I/O operation has in Pre or Post Create?

Q3: When I read the file I must allocate enough buffer size, can I know
the size of the file before I start to read it?

Regards
Mattias Bergkvist

—
NTFSD is sponsored by OSR

For our schedule debugging and file system seminars (including our new
fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@edsiohio.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

7

Hi Mattias,

I will read a file in kernel mode, shall I do that in PreCreate or PostCreat and can I know the length of the file before I begin to read?

I am guessing that you are asking this in the context of your previous queries, antivirus stuff.

Allocation in PostCreate must be nonpaged pool memory.

Ok. Let’s go through it one by one.

What’s the IRQL at which PostCreate is called? PASSIVE_LEVEL. Right?
Secondly, when is it MUST to allocate memory from Non-Paged Pool? When the IRQL>= DISPATCH_LEVEL. Right?

So, if you are sure that you will be accessing this memory ONLY at PASSIVE_LEVEL, why not allocate it from Paged Pool? :slight_smile:

When I read the file I must allocate enough buffer size, can I know the size of the file before I start to read it?

Hmm… you can get the size of the file using FltQueryInformationFile. But decide whether you really need to read the entire file at one go?
Or can you optimize it? Suppose, you are scanning a file and suppose your algorithm is such that you scan only PE files then you may first want to ensure that it is a PE file. For this you may first read the PE header. So, you may allocate only small amount of memory from the pool.
Or if your algorithm needs to read only specific parts in a file, again you may just allocate and read only the required amount.

In short the point is that even if you are allocating from Paged pool, try to optimize how you use it… :slight_smile:

Regards,
Ayush Gupta

8

Outside of the minifilter model, there are no guarantees that I know of.
You have to handle getting it to PASSIVE_LEVEL yourself if that’s
needed.

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Shangwu
Sent: Monday, January 21, 2008 11:56 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Where shall I read a file, in PreCreate or
PostCreat?

A2) Yes, you can use KeGetCurrentIrql. However, it’s not necessary in
the minifilter model - PostCreate runs at PASSIVE_LEVEL.

How do you know if it is not mini-filter model, “PostCreate runs at
PASSIVE_LEVEL”?

9

Hi Mattias,

I will read a file in kernel mode, shall I do that in PreCreate or PostCreat and can I know the length of the file before I begin to read?

I am guessing that you are asking this in the context of your previous queries, antivirus stuff.

Allocation in PostCreate must be nonpaged pool memory.

Ok. Let’s go through it one by one.

What’s the IRQL at which PostCreate is called? PASSIVE_LEVEL. Right?
Secondly, when is it MUST to allocate memory from Non-Paged Pool? When the IRQL>= DISPATCH_LEVEL. Right?

So, if you are sure that you will be accessing this memory ONLY at PASSIVE_LEVEL, why not allocate it from Paged Pool? :slight_smile:

When I read the file I must allocate enough buffer size, can I know the size of the file before I start to read it?

Hmm… you can get the size of the file using FltQueryInformationFile. But decide whether you really need to read the entire file at one go?
Or can you optimize it? Suppose, you are scanning a file and suppose your algorithm is such that you scan only PE files then you may first want to ensure that it is a PE file. For this you may first read the PE header. So, you may allocate only small amount of memory from the pool.
Or if your algorithm needs to read only specific parts in a file, again you may just allocate and read only the required amount.

In short the point is that even if you are allocating from Paged pool, try to optimize how you use it… :slight_smile:

Regards,
Ayush Gupta

10

Thanks for all the answers :slight_smile:

If I have understood it all right.
To get the size of the file I use FltQueryInformation and to allocate memory I use paged pool, but if it is DISPATCH_LEVEL I shall use nonPaged pool instead and all is done in PostCreate.

Is it correct?

Regards
Mattias Bergkvist