Issue multiple reads during IRP_MJ_READ!

NTFSD
1

I am developing a filter driver for encryption / decryption. I would like to
send a few read requests to the lower file system during the IRP_MJ_READ.
For example, send a request to read some header information, and then send
another request to read actual data with some offset. After the multiple
reads completed, I will fill the original read IRP myself. What is the right
approach to do this: building my own IRP to the lower file system or use the
ZwReadFile routine?

For the first case, I always get the status STATUS_MULTIPLE_FAULT_VIOLATION
and STATUS_FILE_CLOSED. I use the original file object in my newly allocated
IRP.

For the second case, if I have a way to avoid reentrancy problem, I still
need to call ZwCreateFile before I can call ZwReadFile because it requires a
file handle. Can I call ZwCreateFile in the IRP_MJ_READ operation using a
system thread? I find out that if I do that, my driver is deadlock when it
is attached on top of a virus scan driver. If I disable the virus scan
driver, there is no deadlock.

I appreciate someone can point me to the right direction. Thank you.

Sin-Lam

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

If you use ZwReadFile you’re gonna catch your own read requests (in other
words you’re gonna have reentrncy problems). So, you might want to create
IRPs from scratch.

----- Original Message -----
From: “Tan Sin Lam”
To: “File Systems Developers”
Sent: Thursday, October 18, 2001 1:59 PM
Subject: [ntfsd] Issue multiple reads during IRP_MJ_READ!

> I am developing a filter driver for encryption / decryption. I would like
to
> send a few read requests to the lower file system during the IRP_MJ_READ.
> For example, send a request to read some header information, and then send
> another request to read actual data with some offset. After the multiple
> reads completed, I will fill the original read IRP myself. What is the
right
> approach to do this: building my own IRP to the lower file system or use
the
> ZwReadFile routine?
>
> For the first case, I always get the status
STATUS_MULTIPLE_FAULT_VIOLATION
> and STATUS_FILE_CLOSED. I use the original file object in my newly
allocated
> IRP.
>
> For the second case, if I have a way to avoid reentrancy problem, I still
> need to call ZwCreateFile before I can call ZwReadFile because it requires
a
> file handle. Can I call ZwCreateFile in the IRP_MJ_READ operation using a
> system thread? I find out that if I do that, my driver is deadlock when it
> is attached on top of a virus scan driver. If I disable the virus scan
> driver, there is no deadlock.
>
> I appreciate someone can point me to the right direction. Thank you.
>
> Sin-Lam
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Hi Alexey,
Thanks for your reply. I did try to send my own read IRP to the lower file
system but I got STATUS_MULTIPLE_FAULT_VIOLATION and STATUS_FILE_CLOSED. I
use the same FileObject from the original IRP. Have you generated your own
IRP for the read request before? Any sample would be useful. Thanks!

Regards,
Sin Lam

If you use ZwReadFile you’re gonna catch your own read requests (in other
words you’re gonna have reentrncy problems). So, you might want to create
IRPs from scratch.

----- Original Message -----
From: “Tan Sin Lam”
> To: “File Systems Developers”
> Sent: Thursday, October 18, 2001 1:59 PM
> Subject: [ntfsd] Issue multiple reads during IRP_MJ_READ!
>
>
> > I am developing a filter driver for encryption / decryption. I would
like
> to
> > send a few read requests to the lower file system during the
IRP_MJ_READ.
> > For example, send a request to read some header information, and then
send
> > another request to read actual data with some offset. After the multiple
> > reads completed, I will fill the original read IRP myself. What is the
> right
> > approach to do this: building my own IRP to the lower file system or use
> the
> > ZwReadFile routine?
> >
> > For the first case, I always get the status
> STATUS_MULTIPLE_FAULT_VIOLATION
> > and STATUS_FILE_CLOSED. I use the original file object in my newly
> allocated
> > IRP.
> >
> > For the second case, if I have a way to avoid reentrancy problem, I
still
> > need to call ZwCreateFile before I can call ZwReadFile because it
requires
> a
> > file handle. Can I call ZwCreateFile in the IRP_MJ_READ operation using
a
> > system thread? I find out that if I do that, my driver is deadlock when
it
> > is attached on top of a virus scan driver. If I disable the virus scan
> > driver, there is no deadlock.
> >
> > I appreciate someone can point me to the right direction. Thank you.
> >
> > Sin-Lam
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@krdl.org.sg
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

I never did it myself but I think I will have to. If you are successful with
this please let me know.

----- Original Message -----
From: “Tan Sin Lam”
To: “File Systems Developers”
Sent: Friday, October 19, 2001 5:23 AM
Subject: [ntfsd] Re: Issue multiple reads during IRP_MJ_READ!

> Hi Alexey,
> Thanks for your reply. I did try to send my own read IRP to the lower
file
> system but I got STATUS_MULTIPLE_FAULT_VIOLATION and STATUS_FILE_CLOSED. I
> use the same FileObject from the original IRP. Have you generated your own
> IRP for the read request before? Any sample would be useful. Thanks!
>
> Regards,
> Sin Lam
>
> > If you use ZwReadFile you’re gonna catch your own read requests (in
other
> > words you’re gonna have reentrncy problems). So, you might want to
create
> > IRPs from scratch.
> >
> > ----- Original Message -----
> > From: “Tan Sin Lam”
> > To: “File Systems Developers”
> > Sent: Thursday, October 18, 2001 1:59 PM
> > Subject: [ntfsd] Issue multiple reads during IRP_MJ_READ!
> >
> >
> > > I am developing a filter driver for encryption / decryption. I would
> like
> > to
> > > send a few read requests to the lower file system during the
> IRP_MJ_READ.
> > > For example, send a request to read some header information, and then
> send
> > > another request to read actual data with some offset. After the
multiple
> > > reads completed, I will fill the original read IRP myself. What is the
> > right
> > > approach to do this: building my own IRP to the lower file system or
use
> > the
> > > ZwReadFile routine?
> > >
> > > For the first case, I always get the status
> > STATUS_MULTIPLE_FAULT_VIOLATION
> > > and STATUS_FILE_CLOSED. I use the original file object in my newly
> > allocated
> > > IRP.
> > >
> > > For the second case, if I have a way to avoid reentrancy problem, I
> still
> > > need to call ZwCreateFile before I can call ZwReadFile because it
> requires
> > a
> > > file handle. Can I call ZwCreateFile in the IRP_MJ_READ operation
using
> a
> > > system thread? I find out that if I do that, my driver is deadlock
when
> it
> > > is attached on top of a virus scan driver. If I disable the virus scan
> > > driver, there is no deadlock.
> > >
> > > I appreciate someone can point me to the right direction. Thank you.
> > >
> > > Sin-Lam
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@krdl.org.sg
> > To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
> >
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com