Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.

Per fltwinerror.h:

//
// MessageId: ERROR_FLT_NO_WAITER_FOR_REPLY
//
// MessageText:
//
// No waiter is present for the filter’s reply to this message.
//
#define ERROR_FLT_NO_WAITER_FOR_REPLY ((HRESULT)0x801F0020L)

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, June 07, 2005 1:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

Yes, it does help. Thank you. (Grumble. I should have found that. Sorry.)

Next question, same stuff

When the driver called FltSendMessage() to start the message exchange, I was
passing a pointer to a LARGE_INTEGER that contained a count of 100 nanosec
units equal to 300 millisec (also tried 1 sec). My intent was to have the
driver go about it’s business if the user space part never answered. The
FltSendMessage() call appears to return immediately for both of these
arguments.

In the examples, the call is always shown with a NULL for the last arg (Only
found 2 cases…) indicating wait forever.

From the help for FltSendMessage():

Timeout
Pointer to a timeout value that specifies the total absolute or relative
length of time, in units of 100 nanoseconds, for which the caller can be put
into a wait state until the message is received by the user-mode application
and until it receives a reply (if one is expected). Set to NULL if the
caller can be put into a wait state indefinitely.

Any suggestions on getting this call to terminate after X time and return
STATUS_TIMEOUT? I’ve never wanted to implement ‘wait forever’ in a driver.

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Tuesday, June 07, 2005 1:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Per fltwinerror.h:

//
// MessageId: ERROR_FLT_NO_WAITER_FOR_REPLY
//
// MessageText:
//
// No waiter is present for the filter’s reply to this message. //
#define ERROR_FLT_NO_WAITER_FOR_REPLY ((HRESULT)0x801F0020L)

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, June 07, 2005 1:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com

Your actual code might help. Note that STATUS_TIMEOUT is a success code.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Wednesday, June 08, 2005 10:34 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Yes, it does help. Thank you. (Grumble. I should have found that. Sorry.)

Next question, same stuff

When the driver called FltSendMessage() to start the message exchange, I was
passing a pointer to a LARGE_INTEGER that contained a count of 100 nanosec
units equal to 300 millisec (also tried 1 sec). My intent was to have the
driver go about it’s business if the user space part never answered. The
FltSendMessage() call appears to return immediately for both of these
arguments.

In the examples, the call is always shown with a NULL for the last arg (Only
found 2 cases…) indicating wait forever.

From the help for FltSendMessage():

Timeout
Pointer to a timeout value that specifies the total absolute or relative
length of time, in units of 100 nanoseconds, for which the caller can be put
into a wait state until the message is received by the user-mode application
and until it receives a reply (if one is expected). Set to NULL if the
caller can be put into a wait state indefinitely.

Any suggestions on getting this call to terminate after X time and return
STATUS_TIMEOUT? I’ve never wanted to implement ‘wait forever’ in a driver.

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Tuesday, June 07, 2005 1:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Per fltwinerror.h:

//
// MessageId: ERROR_FLT_NO_WAITER_FOR_REPLY
//
// MessageText:
//
// No waiter is present for the filter’s reply to this message. //
#define ERROR_FLT_NO_WAITER_FOR_REPLY ((HRESULT)0x801F0020L)

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, June 07, 2005 1:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ken,

Understand STATUS_TIMEOUT is a success code. (I assume it means message sent
& received but no answer sent within alloted time.) That’s OK, that’s what I
want.

Code snippit:

‘UmPtr’ points to a user message struct which contains a size
(total_byte_count). As I have no need for this info once the call is made,
I’m using the same buffer for the return. If I change the comment around the
last call argument, this works fine and I get my expected data. As shown, it
doesn’t work because this part completes before the user end even gets the
message.

The TRACE message reports a hex value equaling 10,000,000 decimal that
represents 1 second. (I assume…)

//
// Deal with ‘answer required’ vs ‘no answer required’
//
if (AnswerRequired) {
ReturnUmPtr = UmPtr;
ReturnUmBufferSizeInBytes = UmBufferSizeInBytes;
Timeout.QuadPart = TIME_TO_WAIT_1_SEC;
}
else {
ReturnUmPtr = 0;
ReturnUmBufferSizeInBytes = 0;
}

d.i = Timeout; // d is a union between LARGE_INTEGER and ULONGs
TRACE2 (" to 0x%08X 0x%08X\n", d.l[1], d.l[0]);

//
// Send the message
//
i = UmPtr->total_byte_count; // for debug - the return overwrites
this value
NtStatus = FltSendMessage (
Filter,
&IoPort_ClientEnd,
UmPtr,
UmPtr->total_byte_count,
ReturnUmPtr,
&ReturnUmBufferSizeInBytes,
&Timeout);
//NULL);

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Wednesday, June 08, 2005 10:50 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Your actual code might help. Note that STATUS_TIMEOUT is a success code.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Wednesday, June 08, 2005 10:34 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Yes, it does help. Thank you. (Grumble. I should have found that. Sorry.)

Next question, same stuff

When the driver called FltSendMessage() to start the message exchange, I was
passing a pointer to a LARGE_INTEGER that contained a count of 100 nanosec
units equal to 300 millisec (also tried 1 sec). My intent was to have the
driver go about it’s business if the user space part never answered. The
FltSendMessage() call appears to return immediately for both of these
arguments.

In the examples, the call is always shown with a NULL for the last arg (Only
found 2 cases…) indicating wait forever.

From the help for FltSendMessage():

Timeout
Pointer to a timeout value that specifies the total absolute or relative
length of time, in units of 100 nanoseconds, for which the caller can be put
into a wait state until the message is received by the user-mode application
and until it receives a reply (if one is expected). Set to NULL if the
caller can be put into a wait state indefinitely.

Any suggestions on getting this call to terminate after X time and return
STATUS_TIMEOUT? I’ve never wanted to implement ‘wait forever’ in a driver.

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Tuesday, June 07, 2005 1:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Per fltwinerror.h:

//
// MessageId: ERROR_FLT_NO_WAITER_FOR_REPLY
//
// MessageText:
//
// No waiter is present for the filter’s reply to this message. //
#define ERROR_FLT_NO_WAITER_FOR_REPLY ((HRESULT)0x801F0020L)

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, June 07, 2005 1:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com

Nope – use -10,000,000. Relative times are negative.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Wednesday, June 08, 2005 11:14 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Ken,

Understand STATUS_TIMEOUT is a success code. (I assume it means message sent
& received but no answer sent within alloted time.) That’s OK, that’s what I
want.

Code snippit:

‘UmPtr’ points to a user message struct which contains a size
(total_byte_count). As I have no need for this info once the call is made,
I’m using the same buffer for the return. If I change the comment around the
last call argument, this works fine and I get my expected data. As shown, it
doesn’t work because this part completes before the user end even gets the
message.

The TRACE message reports a hex value equaling 10,000,000 decimal that
represents 1 second. (I assume…)

//
// Deal with ‘answer required’ vs ‘no answer required’
//
if (AnswerRequired) {
ReturnUmPtr = UmPtr;
ReturnUmBufferSizeInBytes = UmBufferSizeInBytes;
Timeout.QuadPart = TIME_TO_WAIT_1_SEC;
}
else {
ReturnUmPtr = 0;
ReturnUmBufferSizeInBytes = 0;
}

d.i = Timeout; // d is a union between LARGE_INTEGER and ULONGs
TRACE2 (" to 0x%08X 0x%08X\n", d.l[1], d.l[0]);

//
// Send the message
//
i = UmPtr->total_byte_count; // for debug - the return overwrites
this value
NtStatus = FltSendMessage (
Filter,
&IoPort_ClientEnd,
UmPtr,
UmPtr->total_byte_count,
ReturnUmPtr,
&ReturnUmBufferSizeInBytes,
&Timeout);
//NULL);

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Wednesday, June 08, 2005 10:50 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Your actual code might help. Note that STATUS_TIMEOUT is a success code.

Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Wednesday, June 08, 2005 10:34 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Yes, it does help. Thank you. (Grumble. I should have found that. Sorry.)

Next question, same stuff

When the driver called FltSendMessage() to start the message exchange, I was
passing a pointer to a LARGE_INTEGER that contained a count of 100 nanosec
units equal to 300 millisec (also tried 1 sec). My intent was to have the
driver go about it’s business if the user space part never answered. The
FltSendMessage() call appears to return immediately for both of these
arguments.

In the examples, the call is always shown with a NULL for the last arg (Only
found 2 cases…) indicating wait forever.

From the help for FltSendMessage():

Timeout
Pointer to a timeout value that specifies the total absolute or relative
length of time, in units of 100 nanoseconds, for which the caller can be put
into a wait state until the message is received by the user-mode application
and until it receives a reply (if one is expected). Set to NULL if the
caller can be put into a wait state indefinitely.

Any suggestions on getting this call to terminate after X time and return
STATUS_TIMEOUT? I’ve never wanted to implement ‘wait forever’ in a driver.

Regards,
Mickey.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ken Cross
Sent: Tuesday, June 07, 2005 1:36 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter: User space: FilterReplyMessage: return
values?

Per fltwinerror.h:

//
// MessageId: ERROR_FLT_NO_WAITER_FOR_REPLY
//
// MessageText:
//
// No waiter is present for the filter’s reply to this message. //
#define ERROR_FLT_NO_WAITER_FOR_REPLY ((HRESULT)0x801F0020L)

HTH,
Ken

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Tuesday, June 07, 2005 1:14 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter: User space: FilterReplyMessage: return values?

Hi,
Trying to get my user space component of a mini-filter to answer a message
sent from the kernel component.

My reply buffer starts with FILTER_REPLY_HEADER (Status = 0, MessageId =
whatever the kernel sent) and is followed by a single ULONG. Reply buffer
len is set accordingly.

HRESULT return from FilterReplyMessage is 0x801F0020 which looks like an
ERROR_SHARING_VIOLATION from a WIN32 facility (not) identified as 0x1F.

Not sure but I think the kernel component that called FltSendMessage is
getting a satisfactory status w/zero bytes returned. (I’m using the same
kernel buffer for outbound & inbound messages. An issue?)

Any clues?

Regards,
Mickey.


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@comcast.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

While we’re on the subject of FltSendMessage() and FilterReplyMessage()…

The user space message buffer given to FilterReplyMessage() is supposed to
start with FILTER_REPLY_HEADER followed by some user defined data with the
size measuring the whole assembley.

FILTER_REPLY_HEADER consists of “NTSTATUS Status” & “ULONGLONG MessageId”
(12 bytes).

I understand the “MessageId” bit but I have some questions about the
“Status.”

  1. Why is user space using ntstatus.h symbols? (Or have I made another
    assumption I shouldn’t have?)

  2. Does the status value put in FILTER_REPLY_HEADER turn out to be what the
    FltSendMessage() call returns to the calling kernel code? (Assuming some
    other error doesn’t get in there first…)

Regards,
Mickey.

>Nope – use -10,000,000. Relative times are negative.

Ken

Ah HA! Owe you an e-beer.

Mickey.

> 1) Why is user space using ntstatus.h symbols? (Or have I made another

assumption I shouldn’t have?)

Why not? NTSTATUS.H is both for kernel mode and for native user mode code.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com