File System Questions

NTFSD
1

Hi,
I was trying to understand the role of OS and FSD in file access and
sharing. I could not find much information on following topics.

How does OS knows if file is in use? There can be multiple file objects
based on open handles and they all must be linked to particular file path
in some way. How is done that? I know that FSContext is used to link file
objects of same file.

Since there are multiple file objects for a file, each object might have
different share mode. So when a new file object is created, does OS loops
through all the file objects to find if the share mode of new file object
is compatible with existing file objects or does it maintain a “resultant”
share mode from all the existing file objects.

Finally, I believe file locking is also a function of OS as it works with
only File APIs and not with memory mapped files. Is that true?
I need to understand above to design a applications using cloud storage
drives such as OneDrive or Google Drive. I understand all the Windows File
APIs will work with them as share mode, access rights and file locking are
functions of OS.

Thanks
Ash

2

When you mean “how does the OS know” you really mean how does a particular
file system keeps track of its open instances of files.
This usually depends on the filesystem, but all of them have in memory data
structures and synch mechanisms to keep track of all the filesystem
activity, states, locks, oplocks, etc…
For file locks, FSD usually use the already implemented functions provided
by the filesystem runtime library ( FsRtl). You will have to check it out
yourself. I would start with FsRtlAllocateFileLock (
https://msdn.microsoft.com/en-us/library/windows/hardware/ff545640(v=vs.85).aspx
) and take a look at how _FILE_LOCK structure is defined in the WDK (
ntifs.h ). There is no short answer for this, you will have to do some
digging your self. Just know that locks are valid across an entire stream,
and take it from there.
I don’t see why you cannot use locking and memory mapped files. It depends
on the requested rights or access you need to the file map and the range.

Cheers,
Gabriel
www.kasardia.com

On Tue, Jul 19, 2016 at 8:54 AM, Ashish Goyal
wrote:

> Hi,
> I was trying to understand the role of OS and FSD in file access and
> sharing. I could not find much information on following topics.
>
> How does OS knows if file is in use? There can be multiple file objects
> based on open handles and they all must be linked to particular file path
> in some way. How is done that? I know that FSContext is used to link file
> objects of same file.
>
> Since there are multiple file objects for a file, each object might have
> different share mode. So when a new file object is created, does OS loops
> through all the file objects to find if the share mode of new file object
> is compatible with existing file objects or does it maintain a “resultant”
> share mode from all the existing file objects.
>
> Finally, I believe file locking is also a function of OS as it works with
> only File APIs and not with memory mapped files. Is that true?
> I need to understand above to design a applications using cloud storage
> drives such as OneDrive or Google Drive. I understand all the Windows File
> APIs will work with them as share mode, access rights and file locking are
> functions of OS.
>
>
> Thanks
> Ash
> — NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis,
> WDF, Windows internals and software drivers! Details at To unsubscribe,
> visit the List Server section of OSR Online at

–
Bercea. G.

3

>How does OS knows if file is in use? There can be multiple file objects based on open handles and

they all must be linked to particular file path in some way. How is done that? I know that FSContext is
used to link file objects of same file.

Yes.

The mechanism which guarantees that all opens for the same pathname will go to the same on-disk file is inside the FSD. FSD has a structure called FCB, which is private to the FSD, and which is only 1 (if any) for each on-disk file.

But, the FCB has 2 more structures in it - common FCB header and Section Object Pointers - which are allocated and freed by the FSD, but are used by the OS itself (Mm/Cc/FsRtl).

Common FCB header is: file sizes + 2 ERESOURCE locks to guard them.

Section Object Pointers is: 3 pointers to Mm/Cc private structures. One of these is called “Mm control area” (MmCa) which is the implementation of memory mapped files.

new file object is created, does OS loops through all the file objects to find if the share mode

No, the total share mode is accumulated in the FCB and is updated on each new open/close, and, if the total share mode in the FCB prohibits the new open - then it is failed.

Finally, I believe file locking is also a function of OS as it works with only File APIs and not with
memory mapped files. Is that true?

No, the OS just provides the FsRtl locking library for the FSD, and it is the FSD who determines the policy on how to call this library.

I need to understand above to design a applications using cloud storage drives such as OneDrive

I’m not sure OneDrive has FSD in it, I think only the shell extension.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com