Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 5  
05 Oct 17 19:43
Peter Scott
xxxxxx@kerneldrivers.com
Join Date: 17 Feb 2012
Posts To This List: 677
Re[2]: Creating an ADS stream in a Mini Filter

You should not call any of the createfile APIs at APC level. That said,=20 you can queue a request to a worker thread and then block until it=20 completes. But note that there are cases where you may never see a close=20 request on a file, or it may be long after any user mode application has=20 closed it. I would recommend triggering off the cleanup and if you do=20 get additional paging writes after the cleanup, you would only need to=20 do this processing once, correct? I am only guessing from your=20 description though ... Pete -- Kernel Drivers Windows File System and Device Driver Consulting www.KernelDrivers.com 866.263.9295 ------ Original Message ------ From: "xxxxx@gmail.com" <xxxxx@lists.osr.com> To: "Windows File Systems Devs Interest List" <xxxxx@lists.osr.com> Sent: 10/5/2017 1:25:58 PM Subject: RE:[ntfsd] Creating an ADS stream in a Mini Filter >P.S. Why can't I create a file at APC level anyway? > >--- >NTFSD is sponsored by OSR > > >MONTHLY seminars on crash dump analysis, WDF, Windows internals and=20 >software drivers! >Details at <http://www.osr.com/seminars> > <...excess quoted lines suppressed...>
  Message 2 of 5  
05 Oct 17 20:34
M M
xxxxxx@hotmail.com
Join Date: 18 Dec 2012
Posts To This List: 49
Re[2]: Creating an ADS stream in a Mini Filter

BTW having a higher IRQL thread wait for one at a lower level to complete a task is an inherent design problem. It may appear to work just fine for a long time, but it relies on the assumption that you have a machine with an adequate number of cores for another one to ?go do some work for me while I hold this one? (not strictly true for the lower IRQL levels that can be preempted) the architecturally appropriate choice is to have ?work? and the progress on each item to be done tracked by data rather than thread context. This is one of the things quite different about Windows than many other operating systems. You may say, it?s easy for me to say as I don?t have to fix you code. This is true, but if you can figure out how to break your algorithms into appropriate phases of work ? each one to be executed by some arbitrary thread as it picks up the next job that is completely defined by the data ? you will be much happier writing code in Windows KM; and for that matter in KM or UM on any OS. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: PScott <xxxxx@KernelDrivers.com><mailto:xxxxx@lists.osr.com> Sent: October 5, 2017 7:42 PM To: Windows File Systems Devs Interest List<mailto:xxxxx@lists.osr.com> Subject: Re[2]: [ntfsd] Creating an ADS stream in a Mini Filter You should not call any of the createfile APIs at APC level. That said, you can queue a request to a worker thread and then block until it completes. But note that there are cases where you may never see a close request on a file, or it may be long after any user mode application has closed it. I would recommend triggering off the cleanup and if you do get additional paging writes after the cleanup, you would only need to do this processing once, correct? I am only guessing from your description though ... Pete -- Kernel Drivers Windows File System and Device Driver Consulting www.KernelDrivers.com<http://www.KernelDrivers.com> 866.263.9295 ------ Original Message ------ From: "xxxxx@gmail.com" <xxxxx@lists.osr.com> To: "Windows File Systems Devs Interest List" <xxxxx@lists.osr.com> Sent: 10/5/2017 1:25:58 PM Subject: RE:[ntfsd] Creating an ADS stream in a Mini Filter >P.S. Why can't I create a file at APC level anyway? > >--- >NTFSD is sponsored by OSR > > >MONTHLY seminars on crash dump analysis, WDF, Windows internals and >software drivers! >Details at <http://www.osr.com/seminars> > <...excess quoted lines suppressed...> --- NTFSD is sponsored by OSR MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers! Details at <http://www.osr.com/seminars> To unsubscribe, visit the List Server section of OSR Online at <http://www.osronline.com/page.cfm?name=ListServer> --
  Message 3 of 5  
06 Oct 17 09:23
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Re[2]: Creating an ADS stream in a Mini Filter

Thanks very much Pete. I take your point about architecture and I'll look into re-architecting along the lines you suggest. Could you help me understand what it is about APC_LEVEL that precludes file operations? Ian.
  Message 4 of 5  
06 Oct 17 09:31
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 953
List Moderator
Re[2]: Creating an ADS stream in a Mini Filter

>I don't want to make the tagging asynchronous because sometimes the file >gets renamed after it has been closed. You have the rename problem even if you did this inline at IRP_MJ_CLOSE time. The IRP_MJ_CLOSE just means that a File Object is going away, there could be another FIle Object out there being used to rename at the same time. If this is on the network there's not much you can do about this as another client can rename from underneath you (modulo sharing, but that's moot post-IRP_MJ_CLEANUP anyway). If you're local only then you can intercept the rename. >P.S. Why can't I create a file at APC level anyway? TL;DR: It can cause a deadlock FltCreateFile calls ZwCreateFile, which is the Native API for creating a File Object. This operation is synchronous and is (potentially) completed by queuing a Special Kernel APC (SKAPC) to the requesting thread. If you're at APC_LEVEL, SKAPCs are disabled. So, the I/O Manager sends the IRP_MJ_CREATE and blocks waiting for the SKAPC to be delivered to the requesting thread. However, the requesting thread is running at APC_LEVEL and thus blocking the APC. The result is a single threaded deadlock (the most humiliating of all the deadlocks) -scott OSR @OSRDrivers
  Message 5 of 5  
06 Oct 17 10:21
IanM
xxxxxx@gmail.com
Join Date: 01 Jun 2017
Posts To This List: 11
Re[2]: Creating an ADS stream in a Mini Filter

That's great. Thanks Scott.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 15:25.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license