C drive problem

NTFSD
1

Hi All,
I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical
drive other then C: it’s work with out any problem, since there calls
targeted to file system are very limited. Mostly coming from the win32
application on which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls
which are not of my interest to lower device, after certain period of
time I am receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards
Raghwendra

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

2

Raghaven,

I am not sure of what hte problem is, though it looks like you are filtering
PAGING_IO IRPS also. If your page file is located in C:, this might be a
problem.

Ofcourse, I might be absolutely wrong, but I did have such a problem in hand
once.

Regards,

Amitr0

PS:- Keep me posted about this problem and how you solved it.

3

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,

I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical drive
other then C: it’s work with out any problem, since there calls targeted to
file system are very limited. Mostly coming from the win32 application on
which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls which
are not of my interest to lower device, after certain period of time I am
receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards

Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone other
than the intended addressee(s). In case you are not the desired addressee,
you should delete this message and/or re-direct it to the sender. The views
expressed in this E-mail message (including the enclosure(s) or
attachment(s) if any) are those of the individual sender, except where the
sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free
of any virus. However, it is the responsibility of the recipient to ensure
that it is virus free and MBT is not responsible for any loss or damage
arising in any way from its use

********************************************************

4

Hi,
I am using framework from compuware where I am deriving my driver class
from KDriver and my device class from KDevice.

This is how I am intercepting IRP calls
DriverObject() -> MajorFunction[IRP_MJ_CREATE] =
FilterDeviceILGW2K::Create;

Handler function
NTSTATUS FilterDeviceILGW2K::Create(PDEVICE_OBJECT DeviceObject,PIRP I)
{
return PassThrough( I );
}

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)
{
NTSTATUS Status = STATUS_SUCCESS;
IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);
return Status;
}

Now in the above code I am doing nothing but only intercepting Create
IRP calls and with out doing any thing, letting it go down. I case if I
am monitoring these calls for D drive(NON-OS-RESIDENCE) it is working
fine. But with C: Drive (OS INSTALLED). It is giving me page fault after
some time.

The main difference I have observed is in case of D drive limited calls
comes, where as for C: driver lot’s of calls originated from OS comes.

Regards
Raghwendra
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Monday, December 05, 2005 10:26 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,
I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical
drive other then C: it’s work with out any problem, since there calls
targeted to file system are very limited. Mostly coming from the win32
application on which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls
which are not of my interest to lower device, after certain period of
time I am receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards
Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use

********************************************************

5

So, what’s the problem? Page faults occur all the time in the system,
so I’m not sure why this represents an issue for you. Or alternatively,
your statement of the problem is focused on how you think things work
(or should work) versus what the system is really doing.

For this group to help, you’ll have to explain what the system is doing
and the more detail that you provide, the better. But to say “I see
page faults after some time” says absolutely nothing to me (and I
suspect to others) because “page fault” simply means “hardware has
called OS to resolve virtual-to-physical page translation”, whereas I
suspect you are giving it some meaning OTHER than this one (and I assert

  • others correct me if I’m mistaken - that my understanding of page
    fault is the standard one. It’s certainly the one I’ve been teaching
    for a long time…)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 24-27, 2006.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra Kshatriya
Sent: Tuesday, December 06, 2005 8:38 AM
To: ntfsd redirect
Subject: RE: [ntfsd] C drive problem

Hi,

I am using framework from compuware where I am deriving my driver class
from KDriver and my device class from KDevice.

This is how I am intercepting IRP calls

DriverObject() -> MajorFunction[IRP_MJ_CREATE] =
FilterDeviceILGW2K::Create;

Handler function

NTSTATUS FilterDeviceILGW2K::Create(PDEVICE_OBJECT DeviceObject,PIRP I)

{

return PassThrough( I );

}

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

Now in the above code I am doing nothing but only intercepting Create
IRP calls and with out doing any thing, letting it go down. I case if I
am monitoring these calls for D drive(NON-OS-RESIDENCE) it is working
fine. But with C: Drive (OS INSTALLED). It is giving me page fault after
some time.

The main difference I have observed is in case of D drive limited calls
comes, where as for C: driver lot’s of calls originated from OS comes.

Regards

Raghwendra

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Monday, December 05, 2005 10:26 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,

I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical
drive other then C: it’s work with out any problem, since there calls
targeted to file system are very limited. Mostly coming from the win32
application on which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls
which are not of my interest to lower device, after certain period of
time I am receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards

Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

6

In addition to Tony’s comments, your pass-through routine is not
pass-through from what I see. I have not worked with the CompuWare wrapper
but your implementation of

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

Does NOT pass the request down the stack to the next driver. Therefore, from
your original post you are saying that there is an exception being thrown.
Well, if you are not passing down the paging io requests to the underlying
FSD, then things aren’t going to work.

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra Kshatriya
Sent: Tuesday, December 06, 2005 6:38 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

Hi,

I am using framework from compuware where I am deriving my driver class
from KDriver and my device class from KDevice.

This is how I am intercepting IRP calls

DriverObject() -> MajorFunction[IRP_MJ_CREATE] =
FilterDeviceILGW2K::Create;

Handler function

NTSTATUS FilterDeviceILGW2K::Create(PDEVICE_OBJECT DeviceObject,PIRP I)

{

return PassThrough( I );

}

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

Now in the above code I am doing nothing but only intercepting Create IRP
calls and with out doing any thing, letting it go down. I case if I am
monitoring these calls for D drive(NON-OS-RESIDENCE) it is working fine. But
with C: Drive (OS INSTALLED). It is giving me page fault after some time.

The main difference I have observed is in case of D drive limited calls
comes, where as for C: driver lot’s of calls originated from OS comes.

Regards

Raghwendra

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Monday, December 05, 2005 10:26 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,

I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical drive
other then C: it’s work with out any problem, since there calls targeted to
file system are very limited. Mostly coming from the win32 application on
which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls which
are not of my interest to lower device, after certain period of time I am
receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards

Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone other
than the intended addressee(s). In case you are not the desired addressee,
you should delete this message and/or re-direct it to the sender. The views
expressed in this E-mail message (including the enclosure(s) or
attachment(s) if any) are those of the individual sender, except where the
sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free
of any virus. However, it is the responsibility of the recipient to ensure
that it is virus free and MBT is not responsible for any loss or damage
arising in any way from its use

********************************************************

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone other
than the intended addressee(s). In case you are not the desired addressee,
you should delete this message and/or re-direct it to the sender. The views
expressed in this E-mail message (including the enclosure(s) or
attachment(s) if any) are those of the individual sender, except where the
sender expressly, and with authority, states them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be free
of any virus. However, it is the responsibility of the recipient to ensure
that it is virus free and MBT is not responsible for any loss or damage
arising in any way from its use

********************************************************

7

I think OP is talking about PAGE_FAULT_IN_NON_PAGED_AREA bugcheck. If
this is the case, simply fire up SoftICE, load the debug symbols, and
run the driver. SoftICE will tell you where the page fault occurs in
black screen :-). Or alternatively you can set up kernel memory dump and
use windbg. If you haven’t tried Windbg, it isn’t as difficult to use as
you might think. Try it out!

Regards,

Sean

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: Wednesday, 7 December 2005 4:42 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

So, what’s the problem? Page faults occur all the time in the system,
so I’m not sure why this represents an issue for you. Or alternatively,
your statement of the problem is focused on how you think things work
(or should work) versus what the system is really doing.

For this group to help, you’ll have to explain what the system is doing
and the more detail that you provide, the better. But to say “I see
page faults after some time” says absolutely nothing to me (and I
suspect to others) because “page fault” simply means “hardware has
called OS to resolve virtual-to-physical page translation”, whereas I
suspect you are giving it some meaning OTHER than this one (and I assert

  • others correct me if I’m mistaken - that my understanding of page
    fault is the standard one. It’s certainly the one I’ve been teaching
    for a long time…)

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

Looking forward to seeing you at the next OSR File Systems class in
Boston, MA April 24-27, 2006.

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra Kshatriya
Sent: Tuesday, December 06, 2005 8:38 AM
To: ntfsd redirect
Subject: RE: [ntfsd] C drive problem

Hi,

I am using framework from compuware where I am deriving my driver class
from KDriver and my device class from KDevice.

This is how I am intercepting IRP calls

DriverObject() -> MajorFunction[IRP_MJ_CREATE] =
FilterDeviceILGW2K::Create;

Handler function

NTSTATUS FilterDeviceILGW2K::Create(PDEVICE_OBJECT DeviceObject,PIRP I)

{

return PassThrough( I );

}

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

Now in the above code I am doing nothing but only intercepting Create
IRP calls and with out doing any thing, letting it go down. I case if I
am monitoring these calls for D drive(NON-OS-RESIDENCE) it is working
fine. But with C: Drive (OS INSTALLED). It is giving me page fault after
some time.

The main difference I have observed is in case of D drive limited calls
comes, where as for C: driver lot’s of calls originated from OS comes.

Regards

Raghwendra

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Monday, December 05, 2005 10:26 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,

I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical
drive other then C: it’s work with out any problem, since there calls
targeted to file system are very limited. Mostly coming from the win32
application on which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls
which are not of my interest to lower device, after certain period of
time I am receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards

Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s)
or attachment(s) if any) are privileged and confidential material of MBT
and should not be disclosed to, used by or copied in any manner by
anyone other than the intended addressee(s). In case you are not the
desired addressee, you should delete this message and/or re-direct it to
the sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual
sender, except where the sender expressly, and with authority, states
them to be the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

8

Is this passthrough? I don’t think so…

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID >Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

9

This is NOT pass through. You are completing the IRP in what you are
calling PassThrough. If you were passing the IRP down to the next driver
in the next stack, I would first expect you to use a KLowerDevice,
KPnPDevice, or another class that attaches you to the driver stack in
question. Calling IoCompleteRequest does exactly that: it completes the
request and signals the event associated with that IRP.

Pete asked you for the analyze dump; where is it?

The personal opinion of
Gary G. Little

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Kshatriya
Sent: Tuesday, December 06, 2005 7:38 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

Hi,

I am using framework from compuware where I am deriving my driver class
from KDriver and my device class from KDevice.

This is how I am intercepting IRP calls

DriverObject() -> MajorFunction[IRP_MJ_CREATE] =
FilterDeviceILGW2K::Create;

Handler function

NTSTATUS FilterDeviceILGW2K::Create(PDEVICE_OBJECT DeviceObject,PIRP I)

{

return PassThrough( I );

}

NTSTATUS FilterDeviceILGW2K::PassThrough(KIrp I, BOOLEAN bSetCompletion,
PVOID Context)

{

NTSTATUS Status = STATUS_SUCCESS;

IoCompleteRequest(I.m_Irp,IO_NO_INCREMENT);

return Status;

}

Now in the above code I am doing nothing but only intercepting Create IRP
calls and with out doing any thing, letting it go down. I case if I am
monitoring these calls for D drive(NON-OS-RESIDENCE) it is working fine.
But with C: Drive (OS INSTALLED). It is giving me page fault after some
time.

The main difference I have observed is in case of D drive limited calls
comes, where as for C: driver lot’s of calls originated from OS comes.

Regards

Raghwendra

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Scott
Sent: Monday, December 05, 2005 10:26 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] C drive problem

What are you doing to the requests which ARE of interest to you? Can you
post the results of the !analyze -v output?

Pete

Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Raghwendra
Kshatriya
Sent: Monday, December 05, 2005 3:33 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] C drive problem

Hi All,

I have written a FSFD. I am having operating system installed on C:
drive. When I monitor any IRP or FASTIO calls coming for any logical drive
other then C: it’s work with out any problem, since there calls targeted
to file system are very limited. Mostly coming from the win32 application
on which I am doing any I/O operations.

But when I monitor C: drive, here since operating system is installed. N
numbers of IRP/FASTIO calls comes. Though I am passing all those calls
which are not of my interest to lower device, after certain period of time
I am receiving page fault from MmMapLockedPagesSpecifyCache.

Can some one tell me what precaution I should take while monitoring C:
drive.

Regards

Raghwendra

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’

To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone
other than the intended addressee(s). In case you are not the desired
addressee, you should delete this message and/or re-direct it to the
sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual sender,
except where the sender expressly, and with authority, states them to be
the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************

*********************************************************
Disclaimer:
The contents of this E-mail (including the contents of the enclosure(s) or
attachment(s) if any) are privileged and confidential material of MBT and
should not be disclosed to, used by or copied in any manner by anyone
other than the intended addressee(s). In case you are not the desired
addressee, you should delete this message and/or re-direct it to the
sender. The views expressed in this E-mail message (including the
enclosure(s) or attachment(s) if any) are those of the individual sender,
except where the sender expressly, and with authority, states them to be
the views of MBT.

This e-mail message including attachment/(s), if any, is believed to be
free of any virus. However, it is the responsibility of the recipient to
ensure that it is virus free and MBT is not responsible for any loss or
damage arising in any way from its use

********************************************************