Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

What is the status of an Irp when it was written into File IO Buffer

ILBPNSILBPNS Member Posts: 11

If I write data into a file, an Irp will be created.
If it is write directly into file, the irp will go down directly to lower device stack until reach disk device.
But what if the data was written into file system buffer io? After writting into file system buffer, the status of that Irp is PENDING or COMPLETE?

When buffered file data was flush into disk, the data will go through file system again. Will a file system filter
driver get the Irp of these data?

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,210

    After writing into file system buffer, the status of that Irp is PENDING or COMPLETE?

    Complete. The data has been accepted by the operating system. The IO is done.

    Some time later (which may be instantaneous if the file is write through) you'll see another paging irp. When that IO is done the IRP will be marked COMPLETE.

  • ILBPNSILBPNS Member Posts: 11

    @rod_widdowson said:

    After writing into file system buffer, the status of that Irp is PENDING or COMPLETE?

    Complete. The data has been accepted by the operating system. The IO is done.

    Some time later (which may be instantaneous if the file is write through) you'll see another paging irp. When that IO is done the IRP will be marked COMPLETE.

    Thank you for your answer.
    But will a file system filter driver get that paging irp?

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,210

    But will a file system filter driver get that paging irp?

    Oh yes.

    I suggest you spend some time looking at file system operations using a combination of FileTest and procmon (in which the stack trace is particularly educational); it well help you a lot in understanding the flows

  • ILBPNSILBPNS Member Posts: 11

    @rod_widdowson said:

    But will a file system filter driver get that paging irp?

    Oh yes.

    I suggest you spend some time looking at file system operations using a combination of FileTest and procmon (in which the stack trace is particularly educational); it well help you a lot in understanding the flows

    Thank you for your suggestion.
    I'm not familiar with kernel operation.
    But I think your advice will help me a lot.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers TBD Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online