Hi,

I am writing a file system filter driver to intercept the writes to a file. I have handled IRP_MJ_WRITE to obtain the offset and length when a file is being modified.

Also, I have handled the minor function code FSCTL_OFFLOAD_WRITE for the major function code IRP_MJ_FILE_SYSTEM_CONTROL to intercept offloaded writes. The intention is to obtain the offset and lengths for the changes that happen to the file during offloaded data transfer. However, I am not able to find any data structure/member which will give offset and length. FSCTL_OFFLOAD_WRITE is accompanied by FSCTL_OFFLOAD_WRITE_INPUT and FSCTL_OFFLOAD_WRITE_OUTPUT but they appear to be for initiating the ODX operation in conjunction with FSCTL_OFFLOAD_READ and do not appear to be related to FLT_PARAMETERS::FileSystemControl::Buffered that is available on intercepting IRP_MJ_FILE_SYSTEM_CONTROL.

Given that, I am now wondering if Microsoft provided minor function code FSCTL_OFFLOAD_WRITE in major function code IRP_MJ_FILE_SYSTEM_CONTROL, only to give file system filter drivers a right of first refusal in case they want to explicitly block offloaded data transfers. Perhaps, providing the offset and lengths was never the intention? And if it is indeed true, then I am not sure where and how can I obtain the offset and length for the changes that happen within a file on ODX operations.

Highly appreciate any help/advice on how I could possibly obtain the offsets and lengths for offloaded data transfers.

Thanks in advance,
Mandar

Ref:
ODX Considerations for Filter Drivers: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/offloaded-data-transfers#considerations-for-filter-drivers
ODX usage in HyperV/MSSQL: https://docs.netapp.com/ontap-9/index.jsp?topic=/com.netapp.doc.dot-cifs-hypv-sql/GUID-EB7F329D-8E3D-436A-B999-BBB125677271.html