Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

FSCTL_OFFLOAD_WRITE: getting file change offsets for offloaded data transfers

WinCPPWinCPP Member Posts: 6

Hi,

I am writing a file system filter driver to intercept the writes to a file. I have handled IRP_MJ_WRITE to obtain the offset and length when a file is being modified.

Also, I have handled the minor function code FSCTL_OFFLOAD_WRITE for the major function code IRP_MJ_FILE_SYSTEM_CONTROL to intercept offloaded writes. The intention is to obtain the offset and lengths for the changes that happen to the file during offloaded data transfer. However, I am not able to find any data structure/member which will give offset and length. FSCTL_OFFLOAD_WRITE is accompanied by FSCTL_OFFLOAD_WRITE_INPUT and FSCTL_OFFLOAD_WRITE_OUTPUT but they appear to be for initiating the ODX operation in conjunction with FSCTL_OFFLOAD_READ and do not appear to be related to FLT_PARAMETERS::FileSystemControl::Buffered that is available on intercepting IRP_MJ_FILE_SYSTEM_CONTROL.

Given that, I am now wondering if Microsoft provided minor function code FSCTL_OFFLOAD_WRITE in major function code IRP_MJ_FILE_SYSTEM_CONTROL, only to give file system filter drivers a right of first refusal in case they want to explicitly block offloaded data transfers. Perhaps, providing the offset and lengths was never the intention? And if it is indeed true, then I am not sure where and how can I obtain the offset and length for the changes that happen within a file on ODX operations.

Highly appreciate any help/advice on how I could possibly obtain the offsets and lengths for offloaded data transfers.

Thanks in advance,
Mandar

Ref:
ODX Considerations for Filter Drivers: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/offloaded-data-transfers#considerations-for-filter-drivers
ODX usage in HyperV/MSSQL: https://docs.netapp.com/ontap-9/index.jsp?topic=/com.netapp.doc.dot-cifs-hypv-sql/GUID-EB7F329D-8E3D-436A-B999-BBB125677271.html

Comments

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,465

    Aren't FileOffset and CopyLength what you're looking for? Or are you trying to see the data as well?

    -scott
    OSR

  • WinCPPWinCPP Member Posts: 6

    Hi Scott,

    Thanks for the reply.

    Yes, those are the values that I am interested in. Due to oversight, I had missed the fact that the FSCTL_OFFLOAD_WRITE_INPUT is provided through the FLT_PARAMETERS::FileSystemControl::Buffered::SystemBuffer member and it needs to be reinterpreted back to FSCTL_OFFLOAD_WRITE_INPUT to obtain the necessary offset and length. So I think I am good for now.

    Thanks,
    Mandar

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 24 January 2022 Live, Online
Internals & Software Drivers 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online
Developing Minifilters 23 May 2022 Live, Online