PREFETCH_OPEN_ECP_CONTEXT structure (ntifs.h)

The PREFETCH_OPEN_ECP_CONTEXT structure communicates whether the prefetcher performs a given open request on a file.

Syntax

typedef struct _PREFETCH_OPEN_ECP_CONTEXT {
  PVOID Context;
} PREFETCH_OPEN_ECP_CONTEXT, *PPREFETCH_OPEN_ECP_CONTEXT;

Members

Context

A pointer to an opaque context that is associated with the open request.

Remarks

The prefetcher is a component of the operating system that is tightly integrated with the cache manager and the memory manager to make disk accesses more efficient and therefore improve performance. If other components interfere with the prefetcher, system performance decreases and might deadlock. Therefore, the prefetcher attaches the PREFETCH_OPEN_ECP_CONTEXT structure to a file to communicate that the prefetcher has performed an open request on that file. The prefetcher uses the GUID_ECP_PREFETCH_OPEN GUID in a call to the FltCreateFileEx2 or IoCreateFileEx routine to attach the PREFETCH_OPEN_ECP_CONTEXT structure. A file system filter driver (filter) can call FltFindExtraCreateParameter to determine whether PREFETCH_OPEN_ECP_CONTEXT is attached to the file and then take appropriate action. The filter should call the FltIsEcpFromUserMode routine to determine whether the PREFETCH_OPEN_ECP_CONTEXT context structure originated from kernel mode. To prevent malicious applications from spoofing the prefetcher, the filter shouldn't accept PREFETCH_OPEN_ECP_CONTEXT if it originated from user mode.

After the prefetcher attaches the PREFETCH_OPEN_ECP_CONTEXT structure to a file, all additional prefetcher activity for the file involves the file object that has PREFETCH_OPEN_ECP_CONTEXT attached. If a filter must identify prefetcher file system requests other than create requests, the filter should maintain its own state (for example, filter manager handle contexts). The filter maintains its own state in order to determine whether a particular file object is a prefetcher file object.

The memory manager can cache the prefetcher file object. The memory manager can then use the prefetcher file object for other applications that perform mapped I/O or cached I/O by using the cache manager. Therefore, the prefetcher file object can be used for paging I/O before or after the prefetcher closes its handle. This paging I/O can include paging writes, even though the prefetcher never writes any data. The paging writes are generated by other applications. The memory manager writes data from the applications by using its cached prefetcher file object. Therefore, filter performs work that is triggered by paging writes, the filter should still perform that work, even if the paging writes come on a prefetcher file object.

When a filter determines that a cleanup operation occurred on a prefetcher file object, the filter should no longer consider that file object to be prefetcher-opened.

The following are common operations that the prefetcher performs (however, in these operations, the prefetcher never changes file contents):

• Volume open and close
• File open and close
• Query file information
• Set file information (only to instruct the file system not to update last access time for this open)
• Create image and data section
• Perform asynchronous paging I/O

To avoid inducing a possible deadlock situation, a filter should:

• Never block any prefetcher operations.
• Pass prefetcher operations through without issuing other file system requests.

For any application or driver to access any of the data that is being prefetched, it must open its own handle to the file or create a section or both.

For information about how to use ECPs to associate additional information with an IRP_MJ_CREATE operation on a file, see Using Extra Create Parameters with an IRP_MJ_CREATE Operation.

The PREFETCH_OPEN_ECP_CONTEXT structure is read-only. You should use it to retrieve information about a prefetcher open ECP only. For more information about this issue, see System-Defined ECPs.

Requirements

See also

FltCreateFileEx2

FltIsEcpFromUserMode

IoCreateFileEx