Re[2]: Crash on CcWriteBehindInternal

When you process a cached read or write, what is your code path? Do you
pass it down to the underlying file system using the SFO? Or do you call
teh Cc routines yourself? Just trying to get a better understanding of
your implementation.

Pete


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@mauroleggieri.com.ar
To: “Windows File Systems Devs Interest List”
Sent: 2/3/2016 6:08:42 AM
Subject: RE:[ntfsd] Crash on CcWriteBehindInternal

>> If you are not doing anything to the device object (a pure
>>shadow/isolation
>code) then Filtermanager will deal with it for you.
>
>It is a basic redirector, just a folder redirected to another location.
>
>> I think yes, they are absolutely different from the FastIo IO calls,
>>just placed
>to the same array.
>
>I thought Filter Manager routes all Fast IO calls to the callbacks
>installed by FltRegisterFilter and the FastIO dispatch table is handled
>directly by Filter Manager too. Am I missing something?
>
>> One comment you made, since you own
>the upper FO, that is you are taking over the SOP pointer and all, then
>you need to handle the caching calls for this FO not send them down the
>stack to the SFO.
>
>I handle all callbacks from FltRegisterFilter and CcInitializeCacheMap.
>It is possible I’m doing something wrong there but if there exists
>another callbacks I should handle, I don’t know. Maxim pointed to Fast
>IO callbacks but, as said above, as far as I know, Filter Manager
>redirects them to PreOp/PostOp callbacks.
>
>Thanks to all.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

In the pre read/write operations registered with FltRegisterFilter, I switch TargetFileObject and TargetInstance (also I call FltIsIoRedirectionAllowedForOperation and FltPerformSynchronousIo depending if the switch is allowed).

But if there exists a separate callback for cached reads and writes, I couldn’t figure out who they are.