Minifilter equivalent of FsRtlCancellableWait... routines?

NTFSD
1

I have some IO that I block (not pend) for a potentially long time while
I wait on an event. I ran across the FsRtlCancellableWait routines a
while ago, and put an item on my list to look into using them so that I
can make that wait cancellable. So today I took a look at those
functions, and it turns out that they both need a PIRP to work, and I
don’t see any equivalent Flt functions. Are they lurking somewhere
under a strange name, or has Microsoft not provided an implementation
for the minifilter model? If they’re not implemented, what to do?

Thanks,

~Eric

2

They don’t *need* a PIRP to work - the IRP is optional. If you are just waiting on an event, and it’s not associated with cancellation of the Cbd, you can omit the IRP.
http://msdn.microsoft.com/en-us/library/aa906603.aspx
The IRP is needed only if the wait is associated with the IRP. You still get benefits without supplying the IRP, because the wait will break out if the thread is terminating. I agree it would be good to wrap it for minifilters, if the Cbd is associated with the wait. Just sent a note the filter team.
Ravi

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] On Behalf Of Eric Diven [xxxxx@edsiohio.com]
Sent: Wednesday, September 03, 2008 7:10 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Minifilter equivalent of FsRtlCancellableWait… routines?

I have some IO that I block (not pend) for a potentially long time while
I wait on an event. I ran across the FsRtlCancellableWait routines a
while ago, and put an item on my list to look into using them so that I
can make that wait cancellable. So today I took a look at those
functions, and it turns out that they both need a PIRP to work, and I
don’t see any equivalent Flt functions. Are they lurking somewhere
under a strange name, or has Microsoft not provided an implementation
for the minifilter model? If they’re not implemented, what to do?

Thanks,

~Eric

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Let me back up a second real quick. The IRP I need to block is a
pseudo-IRP, IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION. Which means
there is no actual IRP, so I asked the wrong question initially. Which
is also why I can’t just pend the IRP, and have to block instead.

So then, in my case, I would just call the wait with no IRP, and that
makes sense, because I’m not in an IRP based operation. If somebody
kills notepad while I’m waiting, I’d see STATUS_THREAD_IS_TERMINATING
and carry on my way, completing the op unsucessfully, etc.

For an IRP based operation though, how does the IRP actually get
cancelled? If you’re calling this, presumably you haven’t stuck the Cbd
in a CSQ, right?

Thanks,

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ravi Pudipeddi
Sent: Wednesday, September 03, 2008 9:53 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Minifilter equivalent of FsRtlCancellableWait…
routines?

They don’t *need* a PIRP to work - the IRP is optional. If you are just
waiting on an event, and it’s not associated with cancellation of the
Cbd, you can omit the IRP.
http://msdn.microsoft.com/en-us/library/aa906603.aspx
The IRP is needed only if the wait is associated with the IRP. You still
get benefits without supplying the IRP, because the wait will break out
if the thread is terminating. I agree it would be good to wrap it for
minifilters, if the Cbd is associated with the wait. Just sent a note
the filter team.
Ravi

4

Eric
For an IRP-based operation, one can supply the IRP optionally. However the cancel routine should *not* be set in the IRP. Note that one need not have a cancel routine set for Io to attempt to cancel the Irp. The Irp->Cancel flag will be set if the IRP is cancelled.

Passing the IRP in distinguishes the case where the thread is terminating and where the IRP was attempted to be cancelled. The status code returned from this return tells you which of these happened. Since this is synchronous - you don’t need a cancel routine and you will simply complete the IRP as cancelled without having to acquire cancel spinlock etc.

Ravi

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Thursday, September 04, 2008 7:28 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter equivalent of FsRtlCancellableWait… routines?

Let me back up a second real quick. The IRP I need to block is a
pseudo-IRP, IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION. Which means
there is no actual IRP, so I asked the wrong question initially. Which
is also why I can’t just pend the IRP, and have to block instead.

So then, in my case, I would just call the wait with no IRP, and that
makes sense, because I’m not in an IRP based operation. If somebody
kills notepad while I’m waiting, I’d see STATUS_THREAD_IS_TERMINATING
and carry on my way, completing the op unsucessfully, etc.

For an IRP based operation though, how does the IRP actually get
cancelled? If you’re calling this, presumably you haven’t stuck the Cbd
in a CSQ, right?

Thanks,

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ravi Pudipeddi
Sent: Wednesday, September 03, 2008 9:53 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Minifilter equivalent of FsRtlCancellableWait…
routines?

They don’t *need* a PIRP to work - the IRP is optional. If you are just
waiting on an event, and it’s not associated with cancellation of the
Cbd, you can omit the IRP.
http://msdn.microsoft.com/en-us/library/aa906603.aspx
The IRP is needed only if the wait is associated with the IRP. You still
get benefits without supplying the IRP, because the wait will break out
if the thread is terminating. I agree it would be good to wrap it for
minifilters, if the Cbd is associated with the wait. Just sent a note
the filter team.
Ravi

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

Hello Eric,

Actually, it appears that the wrappers do exist, but they aren’t documented. FltCancellableWaitForSingleObject and FltCancellableWaitForMultipleObjects. You should be able to find the declarations in fltkernel.h . Should be available since vista RTM.

I don’t expect you’ll have any trouble using them.

I’ll file the documentation bug…

Regards,
Alex.
This posting is provided “AS IS” with no warranties, and confers no rights.

6

Let me clarify this API’s applicability a bit more , given that I really would like hard hangs to go away completely.

Normally - for most i/o’s you’d really want to set cancel routine and queue it in the Cbdq and return pending. That is the recommended thing to do if you can. This API is only applicable for the cases where you are synchronously waiting while holding on to an IRP - typically I have seen this on creates where the thread wants to synchronize back because it needs to do post-processing in the same context.
So if you look through your code and look for : KeWaitForSingleObject( x, y, KernelMode, FALSE, z) (or KeWaitForMultipleObjects) - these are paths where the thread will not respond to termination or IRP cancellation. These are simple candidates for using the cancellable wait instead so they can break out of the wait.
Ravi

-----Original Message-----
From: Ravi Pudipeddi
Sent: Thursday, September 04, 2008 11:26 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter equivalent of FsRtlCancellableWait… routines?

Eric
For an IRP-based operation, one can supply the IRP optionally. However the cancel routine should *not* be set in the IRP. Note that one need not have a cancel routine set for Io to attempt to cancel the Irp. The Irp->Cancel flag will be set if the IRP is cancelled.

Passing the IRP in distinguishes the case where the thread is terminating and where the IRP was attempted to be cancelled. The status code returned from this return tells you which of these happened. Since this is synchronous - you don’t need a cancel routine and you will simply complete the IRP as cancelled without having to acquire cancel spinlock etc.

Ravi

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Eric Diven
Sent: Thursday, September 04, 2008 7:28 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Minifilter equivalent of FsRtlCancellableWait… routines?

Let me back up a second real quick. The IRP I need to block is a
pseudo-IRP, IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION. Which means
there is no actual IRP, so I asked the wrong question initially. Which
is also why I can’t just pend the IRP, and have to block instead.

So then, in my case, I would just call the wait with no IRP, and that
makes sense, because I’m not in an IRP based operation. If somebody
kills notepad while I’m waiting, I’d see STATUS_THREAD_IS_TERMINATING
and carry on my way, completing the op unsucessfully, etc.

For an IRP based operation though, how does the IRP actually get
cancelled? If you’re calling this, presumably you haven’t stuck the Cbd
in a CSQ, right?

Thanks,

~Eric

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ravi Pudipeddi
Sent: Wednesday, September 03, 2008 9:53 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Minifilter equivalent of FsRtlCancellableWait…
routines?

They don’t *need* a PIRP to work - the IRP is optional. If you are just
waiting on an event, and it’s not associated with cancellation of the
Cbd, you can omit the IRP.
http://msdn.microsoft.com/en-us/library/aa906603.aspx
The IRP is needed only if the wait is associated with the IRP. You still
get benefits without supplying the IRP, because the wait will break out
if the thread is terminating. I agree it would be good to wrap it for
minifilters, if the Cbd is associated with the wait. Just sent a note
the filter team.
Ravi

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com