Hello All,
We have a already written minifilter in which we are handling oplocks.
In this minifilter, we want to monitoring Windows 7 oplock acquire and release operation.
To check oplock acquire we used following code in IRP_MJ_FILE_SYSTEM_CONTROL:
if ((ucMajorFunction == IRP_MJ_FILE_SYSTEM_CONTROL) &&
(ucMinorFunction == IRP_MN_USER_FS_REQUEST) &&
(ulFsControlCode == FSCTL_REQUEST_OPLOCK)){
pOplockInBuff = (REQUEST_OPLOCK_INPUT_BUFFER *)pvSysBuff;
if (pOplockInBuff->Flags & REQUEST_OPLOCK_INPUT_FLAG_REQUEST){
if ((pOplockInBuff->RequestedOplockLevel & OPLOCK_LEVEL_CACHE_HANDLE) || (pOplockInBuff->RequestedOplockLevel & OPLOCK_LEVEL_CACHE_WRITE)){
// This is Windows 7 oplock operation.
}
}
}
How to trace/check oplock release operation for this?
Regards,
Rajendra.
Hi Rajendra,
The oplock is an IRP and it will be pended if and while it’s granted. So
you can simply wait for the postOp callback and it will be called when the
oplock is completed and then you can see what the status was.
Thanks,
Alex.
On Mon, Jun 9, 2014 at 11:24 PM, wrote:
> Hello All,
>
> We have a already written minifilter in which we are handling oplocks.
> In this minifilter, we want to monitoring Windows 7 oplock acquire and
> release operation.
> To check oplock acquire we used following code in
> IRP_MJ_FILE_SYSTEM_CONTROL:
> if ((ucMajorFunction == IRP_MJ_FILE_SYSTEM_CONTROL) &&
> (ucMinorFunction == IRP_MN_USER_FS_REQUEST) &&
> (ulFsControlCode == FSCTL_REQUEST_OPLOCK)){
> pOplockInBuff = (REQUEST_OPLOCK_INPUT_BUFFER *)pvSysBuff;
> if (pOplockInBuff->Flags & REQUEST_OPLOCK_INPUT_FLAG_REQUEST){
> if ((pOplockInBuff->RequestedOplockLevel &
> OPLOCK_LEVEL_CACHE_HANDLE) || (pOplockInBuff->RequestedOplockLevel &
> OPLOCK_LEVEL_CACHE_WRITE)){
> // This is Windows 7 oplock operation.
> }
> }
> }
>
> How to trace/check oplock release operation for this?
>
> Regards,
> Rajendra.
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Hi Alex,
Thanks for your reply.
In minifilter, we are maintaining list of files opened in oplock.
In file notification callback, we check for file entry in oplock list. If present, we do not notify this event to user mode application to avoid oplock break/blocking wait on file.
Once oplock is released for file, we want to remove file entry from list and notify event for this file to user mode application.
We used function FltRequestOperationStatusCallback() in Pre-FSCTL callback to check oplock status.
If we get OperationStatus as STATUS_PENDING in PFLT_GET_OPERATION_STATUS_CALLBACK, we added file in oplock file list.
In Post-FSCTL callback, currently we are checking status to STATUS_SUCCESS to remove the entry from list.
But sometimes we are receiving status code as STATUS_OPLOCK_HANDLE_CLOSED or STATUS_CANCELLED for files added in oplock list. And hence files are not getting removed from list.
Can we consider the return status code STATUS_OPLOCK_HANDLE_CLOSED as oplock break and remove entry from list?
Regards,
Rajendra.
Hi Rajendra,
Yeah, when the IRP completes for whatever reason, the oplock is no longer
associated with the IRP because there is no way for the filesystem to
signal what happens with the oplock. Another way to put this is that there
is never an oplock associated with a completed IRP.
Thanks,
Alex.
On Thu, Jun 12, 2014 at 4:31 AM, wrote:
> Hi Alex,
>
> Thanks for your reply.
>
> In minifilter, we are maintaining list of files opened in oplock.
> In file notification callback, we check for file entry in oplock list. If
> present, we do not notify this event to user mode application to avoid
> oplock break/blocking wait on file.
> Once oplock is released for file, we want to remove file entry from list
> and notify event for this file to user mode application.
>
> We used function FltRequestOperationStatusCallback() in Pre-FSCTL callback
> to check oplock status.
> If we get OperationStatus as STATUS_PENDING in
> PFLT_GET_OPERATION_STATUS_CALLBACK, we added file in oplock file list.
>
> In Post-FSCTL callback, currently we are checking status to STATUS_SUCCESS
> to remove the entry from list.
> But sometimes we are receiving status code as STATUS_OPLOCK_HANDLE_CLOSED
> or STATUS_CANCELLED for files added in oplock list. And hence files are not
> getting removed from list.
>
> Can we consider the return status code STATUS_OPLOCK_HANDLE_CLOSED as
> oplock break and remove entry from list?
>
> Regards,
> Rajendra.
>
>
> —
> NTFSD is sponsored by OSR
>
> OSR is hiring!! Info at http://www.osr.com/careers
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Thanks Alex for suggestions.
We are implementing as below:
[PreFSCTL callback]
Check for specific oplock operation
If oplock granted
Add file entry in oplock granted list
Set flag for added entry in context and pass it to PostFSCTL
[PosFSCTL callback]
Check for context set
If the flag for added entry is present ,remove file entry from oplock granted list
Regards,
Rajendra.