"file not closed properly" it does mean: I have opened up this file, then my minifilter crashed the node(so handle was not closed up), and I am restarted the node, after that, when I am triing to open that file I got STATUS_DUPLICATE_NAME. So I need to restart server with storage. Then all works againe. That is not crytical for me... just inform you.
Filter is attached to the to CSVFS. By the way. You are writing in the avscan
// Determine if the filter is attaching to the hidden NTFS volume
// that corresponds to a CSV volume. If so do not attach. Note
// that it would be feasible for the filter to attach to this
// volume as part of a distrubuted filter implementation but that
// is beyond the scope of this sample.
if (VolumeFilesystemType == FLT_FSTYPE_NTFS) {
isOnCsv = AvIsVolumeOnCsvDisk( FltObjects->Volume );
if (isOnCsv) {
return STATUS_FLT_DO_NOT_ATTACH;
}
}
Why any distrubuted filter need to attach to the "hidden NTFS volume that corresponds to a CSV volume" if he can attach to the CSVFS and to use oplocks and so on for distrubuted synchronization?
Now I am triing to make something like CSV-aware Metadata Manager Minifilter). And I see defferent interesing things. One new one:
When I got MetadataFileOplockWriteBreak then I need to modify flag in InstanceContext to know that I am not have write acces now, before do this I need to lock MetadataResource localy, like in Metadata Manager Minifilter driver sample:
FLT_ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
FLT_ASSERT(ExIsResourceAcquiredExclusiveLite(&InstanceContext->MetadataResource) ||
!ExIsResourceAcquiredSharedLite(&InstanceContext->MetadataResource));
KeEnterCriticalRegion();
(VOID)ExAcquireResourceExclusiveLite(&InstanceContext->MetadataResource, TRUE);
Here I got BSOD FILE_SYSTEM (22) IF you are interesting in !analyze -v paste.ofcode.org/vFhuAnrh7LehTC3MXWWrqA
I think I MUST leave CriticalRegion and release Resource before calling oplock IOCLs and that will fix. P.S. It would be so good to have some example CSV-aware minifilter with internodes syncronyzation.