Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

On-Access, Transparent, Per-File Data Encryption:

OSR's File Encryption Solution Framework (FESF) provides all the infrastructure you need to build a transparent file encryption product REALLY FAST.

Super flexible policy determination and customization, all done in user-mode. Extensive starter/sample code provided.

Proven, robust, flexible. In use in multiple commercial products.

Currently available on Windows. FESF for Linux will ship in 2018.

For more info: https://www.osr.com/fesf

Go Back   OSR Online Lists > ntfsd
Welcome, Guest
You must login to post to this list
  Message 1 of 7  
16 May 17 14:14
Anand Arun
xxxxxx@gmail.com
Join Date: 19 Oct 2016
Posts To This List: 9
Refcounting in file system minifilter driver

Hi All, I am developing a file system filter minifilter driver to track changes to specific files or files of specific type. I will attach a file context in PostOperationCallback() for IRP_MJ_CREATE and use this in PreOperationCallback() of IRP_MJ_WRITE and IRP_MJ_CLOSE. If the driver has been loaded and attached after some IRP_MJ_CREATE calls have already gone through, is there a way to find the current refcount (through ObjectManager?) so that the same could be taken into consideration to determine when the file context attached by the driver needs to be cleared ? I have read this article : http://www.osronline.com/article.cfm?id=102 It states the same issue with the proposed algo : "Do note that this algorithm only works if your filter observes all operations against this file - if you dynamically load your filter driver and the file has already been opened prior to that, this algorithm will not suffice." I am targeting Windows Server 2012 [R2]. I cannot rely on the IRP_MJ_CLEANUP callback because the environment where I am running (HyperV on CSV) could have a case of VM failover - failback and hence the file could be closed on host1, opened, written to and closed from host 2 and then re-opened from host1 and if all this happens in a short duration before cache manager removes the file context then the correctness of change tracking will be lost. Thanks, Anand.
  Message 2 of 7  
16 May 17 18:40
Peter Scott
xxxxxx@kerneldrivers.com
Join Date: 17 Feb 2012
Posts To This List: 663
Refcounting in file system minifilter driver

There is no documented, or consistent and reliable undocumented way to=20 do this. The only components that would know, across all open instances=20 of a file, what the ref count is on that file would be the file system=20 or an fs filter that has processed all open requests. Why can't you load your filter at boot time, if this is a requirement? Pete -- Kernel Drivers Windows File System and Device Driver Consulting www.KernelDrivers.com 866.263.9295 ------ Original Message ------ From: xxxxx@gmail.com To: "Windows File Systems Devs Interest List" <xxxxx@lists.osr.com> Sent: 5/16/2017 12:14:35 PM Subject: [ntfsd] Refcounting in file system minifilter driver >Hi All, > >I am developing a file system filter minifilter driver to track changes= =20 >to specific files or files of specific type. I will attach a file=20 >context in PostOperationCallback() for IRP_MJ_CREATE and use this in=20 >PreOperationCallback() of IRP_MJ_WRITE and IRP_MJ_CLOSE. > >If the driver has been loaded and attached after some IRP_MJ_CREATE=20 >calls have already gone through, is there a way to find the current=20 >refcount (through ObjectManager?) so that the same could be taken into=20 >consideration to determine when the file context attached by the driver= =20 >needs to be cleared ? > >I have read this article : http://www.osronline.com/article.cfm?id=3D102 > >It states the same issue with the proposed algo : "Do note that this=20 >algorithm only works if your filter observes all operations against=20 >this file - if you dynamically load your filter driver and the file has= =20 >already been opened prior to that, this algorithm will not suffice." > >I am targeting Windows Server 2012 [R2]. I cannot rely on the=20 >IRP_MJ_CLEANUP callback because the environment where I am running=20 >(HyperV on CSV) could have a case of VM failover - failback and hence=20 >the file could be closed on host1, opened, written to and closed from=20 >host 2 and then re-opened from host1 and if all this happens in a short= =20 >duration before cache manager removes the file context then the=20 >correctness of change tracking will be lost. > >Thanks, >Anand. > >--- >NTFSD is sponsored by OSR > > <...excess quoted lines suppressed...>
  Message 3 of 7  
17 May 17 00:16
Anand Arun
xxxxxx@gmail.com
Join Date: 19 Oct 2016
Posts To This List: 9
Refcounting in file system minifilter driver

I am trying to solve the problem for already running VM scenario when the driver is installed for the first time for which incremental change tracking is desirable after the first full backup. Subsequent to reboot of host or power off/on of VM, it will work fine.
  Message 4 of 7  
17 May 17 09:47
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 903
List Moderator
Refcounting in file system minifilter driver

All this reference counting nonsense only related to legacy filters. These days Filter Manager deals with all of that, you just need to worry about using the FltXxx APIs properly. See the Context sample: https://github.com/Microsoft/Windows-driver-samples/tree/master/filesys/miniFilte r/ctx -scott OSR @OSRDrivers wrote in message news:102542@ntfsd... Hi All, I am developing a file system filter minifilter driver to track changes to specific files or files of specific type. I will attach a file context in PostOperationCallback() for IRP_MJ_CREATE and use this in PreOperationCallback() of IRP_MJ_WRITE and IRP_MJ_CLOSE. If the driver has been loaded and attached after some IRP_MJ_CREATE calls have already gone through, is there a way to find the current refcount (through ObjectManager?) so that the same could be taken into consideration to determine when the file context attached by the driver needs to be cleared ? I have read this article : http://www.osronline.com/article.cfm?id=102 It states the same issue with the proposed algo : "Do note that this algorithm only works if your filter observes all operations against this file - if you dynamically load your filter driver and the file has already been opened prior to that, this algorithm will not suffice." I am targeting Windows Server 2012 [R2]. I cannot rely on the IRP_MJ_CLEANUP callback because the environment where I am running (HyperV on CSV) could have a case of VM failover - failback and hence the file could be closed on host1, opened, written to and closed from host 2 and then re-opened from host1 and if all this happens in a short duration before cache manager removes the file context then the correctness of change tracking will be lost. Thanks, Anand.
  Message 5 of 7  
18 May 17 02:07
Anand Arun
xxxxxx@gmail.com
Join Date: 19 Oct 2016
Posts To This List: 9
Refcounting in file system minifilter driver

Thanks Scott. I am using per file context (FltSetFileContext()). So, IIUC from the sample and reading (https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/releasing-contexts ), the FltReleaseContext() call corresponding to a successful call of FltSetFileContext() need not be made (by the minifilter driver). Now, I still have a few questions : 1) How can my driver get to know when this reference is released? I understand that this could be well after the last handle to the file is closed. Is there a callback I can register for ? 2) In the CSV environment (with NTFS) is it so that the context gets released as soon as last handle to the file is closed ? That seems to be the case based on my experimentation (on CSV owner node, experimenting further) but I do not want to make any assumptions unless there is some documentation about it or others have made similar observations. I have not yet set any block cache for CSV, will check with that too but wondering if that should have any impact
  Message 6 of 7  
18 May 17 03:11
Anand Arun
xxxxxx@gmail.com
Join Date: 19 Oct 2016
Posts To This List: 9
Refcounting in file system minifilter driver

Sorry, please ignore question #1 in the above post. The answer to that is known : https://msdn.microsoft.com/library/windows/hardware/ff551078 I was thinking that there will be a way to specify the cleanup callback at the time of setting the context.
  Message 7 of 7  
18 May 17 15:01
Scott Noone
xxxxxx@osr.com
Join Date: 10 Jul 2002
Posts To This List: 903
List Moderator
Refcounting in file system minifilter driver

The file context only goes away when the last reference (not HANDLE) to the last file object goes away. This may effectively never happen due to the wonders of caching. -scott OSR @OSRDrivers wrote in message news:102547@ntfsd... Sorry, please ignore question #1 in the above post. The answer to that is known : https://msdn.microsoft.com/library/windows/hardware/ff551078 I was thinking that there will be a way to specify the cleanup callback at the time of setting the context.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntfsd list to be able to post.

All times are GMT -5. The time now is 07:46.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license