当前位置：首页 » 编程博文

开发技术指南» 文章正文

    引言： File System FilTer Manager Fi

 

 

（转载）ms 的 Filter Driver Development Guide
file system filter manager

  【程序编程相关:一个Mysql自动备份脚本】

filter driver development guide 【推荐阅读:VB计算农历的算法】

  【扩展信息:破解本地的mysql用户名和密码】

 

summary

this specification includes, but is not limited to, the following topic areas:

·          description of the new ´file system filter manager´ architecture and interfaces

·          aspects of the windows ´memory manager´, ´i/o manager´, and ´cache manager´ interfaces that affect the development of file system filters using the new file system filter manager architecture.

disclaimer

the information contained in this document represents the current view of microsoft corporation on the issues discussed as of the date of publication. because microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of microsoft, and microsoft cannot guarantee the accuracy of any information presented after the date of publication.

 

this white paper is for informational purposes only. microsoft makes no warranties, express, implied or statutory, as to the information in this document.

 

complying with all applicable copyright laws is the responsibility of the user. without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of microsoft corporation.

 

microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. except as expressly provided in any written license agreement from microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

 

unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, email address, logo, person, place or event is intended or should be inferred.

 

© 2004 microsoft corporation.  all rights reserved.

 

microsoft, windows, and windows nt are either registered trademarks or trademarks of microsoft corporation in the united states and/or other countries.

 

the names of actual companies and products mentioned herein may be the trademarks of their respective owners.

table of contents

1.   overview.. 3

2.   terms. 3

3.   minifilter installation. 4

4.   minifilter registration. 4

5.   initiating filtering. 4

6.   instance notification support 5

6.1.      setting up an instance. 5

6.2.      controlling instance teardown. 6

6.3.      synchronizing instance detach. 6

7.   callback support 7

7.1.      callback data. 7

7.2.      pre-operation callbacks. 8

7.3.      post-operation callbacks. 9

8.   manipulating callback data parameters. 11

8.1.      i/o parameter block. 11

8.2.      accessing buffer/mdl. 12

8.3.      swapping buffers. 13

9.   context support 13

9.1.      context registration. 14

9.2.      context creation apis. 14

9.3.      context retrieval apis. 17

9.4.      context freeing apis. 18

10. user mode communication. 19

10.1.    filter communication port object 19

10.2.    connecting to communication port from user mode. 20

10.3.    disconnecting from the communication port 21

10.4.    unload issues. 21

11. file name support 21

11.1.    retrieving a file name during an operation. 21

11.2.    additional support for file names. 23

11.3.    interfaces for name providing filters. 23

12. filter initiated i/o. 25

13. rules for unload/unregister/detach. 27

14. support routines. 27

15. building a minifilter. 28

 

1.                          overview

this document pertains to filter drivers between the i/o manager and the base filesystem, which can be local or remote.  it does not pertain to filter drivers that sit between the filesystem and the storage driver(s), such as ftdisk or dmio.

we will refer to a file system filter driver written using the new model as a mini file system filter driver/minifilter.

the existing file system filters based on the sfilter sample – using irp and device-object based filtering will be referred to as ´legacy filters´.

one of the key components of the new architecture is a legacy file system filter which is called ´filter manager´.  in future windows operating system releases, this driver will be installed by default on the system. this driver manages the minifilters by providing export libraries to which the minifilters link.  the necessary header files, libraries and binaries are available in the minifilter ifskit.

why write a mini file system filter driver?

·          simpler, get a more reliable filter driver with less development effort.

·          dynamic load and unload, attach and detach.

·          attach at a well-defined location in the filter stack.

·          context management: fast, clean, reliable contexts for file objects, streams, files, instances, and volumes

·          a host of utility routines including support for looking up names and caching them for efficient access, communication between minifilters and user mode services, and io queuing.

·          support non-recursive i/o so minifilter generated i/o can easily be seen only by lower minifilters and the file system.

·          filter only operations of interest to minifilter – unlike the legacy model where a filter has to hook every entry point to pass through operation.

2.                          terms

in the filter manager architecture, some new objects are defined.  for clarity these objects will be defined up front.

filter: a driver that performs some type of filtering operation on the file system.

volume:  for local file systems, the object that represents logical volume the file system manages.  for network redirectors, this represents the object to which all network requests are directed.  the volume maps directly to the file system (local or remote) device_object in the legacy filter model.

instance:  an instantiation of a filter on a volume at a unique altitude.  the filter manager manages presenting ios to each instance in the stack of instances attached to a volume.  there may be more than one instance of a given minifilter for a given volume.  the canonical example is a filter like filespy.  it would be helpful to attach filespy both above and below another filter on the same volume with each instance maintaining a private context.  this context could contain the log of ios seen by the instance for later comparison of the io as seen above and below the filter.

file:  a named object of data that could be composed of multiple streams that is stored on a disk by the file system.

stream:  represents a physical stream of data in a file.

fileobject:  represents a user’s open of a physical stream of data in a file.

callbackdata:  the filter manager structure that encapsulates all the information about an operation.  this is equivalent to an irp in the legacy filter model.

3.                          minifilter installation

minifilters will be installed via an inf file.  the inf file indicates what instances the minifilter supports. instances are defined in section 5.  each instance is also accompanied by an altitude value which indicates its absolute position in a minifilter stack and a set of flags.

the list of instances with their altitudes in the inf is the preferred means for file system filter vendors to ship their minifilters.  the flags indicate if the minifilter needs ´automatic attachment´. if this is the case, for every volume in the system (and for new ones as they arrive), the minifilter gets a notification that it can respond to and attach. the altitude in the inf file determines the altitude to which the minifilter attaches if it chooses to do so.

a file system filter vendor may also create an instance dynamically at a specified altitude at any time when the minifilter is running via the filterattachataltitude() function. this is provided as an override and a potential debugging and testing aid.

4.                          minifilter registration

mini file system filter drivers are kernel-mode drivers.  as such, they must export a function called driverentry(), which will be the first function invoked when the driver is loaded.  most minifilters will call fltregisterfilter() in their driverentry(). 

fltregisterfilter() takes as a parameter a flt_registration structure, which contains an unload routine, instance notification callbacks, a list of context callback function pointers and a list of file system operation callback pointers.  in the most common case, where the minifilter hooks just a few operations, this list can be very short. 

the minifilter also can specify additional flags for each operation that controls whether it receives the callbacks in all cases. for instance, if fltfl_operation_registration_skip_paging_io is supplied, the minifilter will not receive any paging i/o operations for that particular irp major code.

similarly, if fltfl_operation_registration_skip_cached_io is specified, only the non-cached i/o path will be seen for that operation (i.e., if it is supplied for irp_mj_read, all cached read paths will be skipped by that minifilter).

5.                          initiating filtering

once a minifilter registers itself, it should initiate filtering at some point by calling the function fltstartfiltering(). it is not necessary to call it from driverentry(), though most filters will probably prefer to.

this function will kick-off the necessary notifications that will result in the minifilter attaching to the appropriate volumes and start filtering i/o. 

for this the filter manager walks through the list of instances that are registered by the minifilter via its inf.

each instance specifies an "altitude". an altitude is an infinite precision string (e.g., "100.123456") that defines where it will be attached in a stack of minifilter instances.  altitudes for commercially released minifilter drivers will be assigned by microsoft. 

...   下一页

» 本期热门文章：

· 热门栏目：

» 相关精选文章

» 其它相关：