Minimize how long files stay open after CLEANUP

NTFSD
1

I have a File System Driver (not Filter), which processes IRP’s by forwarding them to user mode where the real processing happens. The driver behaves well and passes many test suites.

One problem that I am facing is that files often remain open long after the last CLEANUP is received. A usual explanation is that files end up in the “standby list”. Indeed there is a sysinternals tool called RAMMap, which can be used to empty the “standby list”; usually this results in a flurry of CLOSE calls as the OS dereferences all these files.

In general the delayed CLOSE behavior is not an issue, but some user mode file systems run out of resources when they have too many files open simultaneously. Therefore I am looking to add an option to eliminate or minimize the time that files spend in the “standby list”.

I have tried various experiments with MmForceSectionClosed, but this call does not seem reliable. Does anyone have any insights on how to control the “standby list”, or how to control how long files remain open after the last CLEANUP?

2

MmForceSectionClosed

3

IIRC you can use this routine in cleanup call back also u need to think about the flag
Delete_on_close which you get in Precreate() which will wait in cleanup call back for last reference.
hope it may help.

4

Asking the obvious…

You have tried CcCoherencyFlushAndPurgeCache/CcPurgeCacheSection?

I have never had issues with them that have not been provoked by sections
still being open…

5

Rod:

You have tried CcCoherencyFlushAndPurgeCache/CcPurgeCacheSection?

I was fairly certain that I had done so in an experiment previously.

Then after sending my message last night, I decided to try them again and indeed I got the intended effect of keeping the files off the “standby” list.

Of interesting note is that the pair of CcFlushCache/CcPurgeCacheSection worked better in my file system than CcCoherencyFlushAndPurgeCache for this purpose. I use CcCoherencyFlushAndPurgeCache in the READ and WRITE handlers, but my use in CLEANUP resulted in far reduced performance. (I understand that by flushing/purging the cache, performance should be affected, but the slowdown was beyond what I would consider normal in the CcCoherencyFlushAndPurgeCache.)

I am keeping CcFlushCache/CcPurgeCacheSection for now. Thanks for confirming that they should work for this purpose.