Can I filter the I/O manager?

NTFSD
1

Hi all.

I need to make a filter driver that filte the I/O manager.
The IPR which goes into the I/O manager, must goes into my filter driver first.

Is that possible to make it?

2

Do you mean filter the IRP’s for a certain device stack or filter ALL IRP’s?

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of dcg1981@163.com
Sent: Wednesday, August 25, 2010 9:20 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Can I filter the I/O manager?

Hi all.

I need to make a filter driver that filte the I/O manager.
The IPR which goes into the I/O manager, must goes into my filter driver
first.

Is that possible to make it?

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Thanks.

I need to filter the IRP which will be sent to a volume device.

4

Have you looked at the WDK storage docs yet? Also, there’s the diskperf
sample, though that may or may not be what you want exactly (this is not my
area).

Good luck,

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of dcg1981@163.com
Sent: Wednesday, August 25, 2010 9:50 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Can I filter the I/O manager?

Thanks.

I need to filter the IRP which will be sent to a volume device.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

Thanks.

I think the running track of IRPs should be USER -> I/O Manager -> filter drivers -> file system -> volume …

Now I need to capture the IRP before it comes to I/O manager.

I don’t know how to do that. I do not even know if it can be done.

6

Why do you think that you need to do this?

mm

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of dcg1981@163.com
Sent: Wednesday, August 25, 2010 10:03 PM
To: Windows File Systems Devs Interest List
Subject: RE:[ntfsd] Can I filter the I/O manager?

Thanks.

I think the running track of IRPs should be USER -> I/O Manager -> filter
drivers -> file system -> volume …

Now I need to capture the IRP before it comes to I/O manager.

I don’t know how to do that. I do not even know if it can be done.

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars (including our new fs
mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

7

Ah… It is a long story.

Simply said that I changed the target volume of the IRP, so I must change the user buf if the IRP is Rename operation. And this must be done before the IRP come to I/O manager.

8

Can anybody give me some hint?

9

Hint: Windows Internals latest edition.

@I think the running track of IRPs should be USER -> I/O Manager -> filter drivers -> file system -> volume … Now I need to capture the IRP before it comes to I/O manager.

Now I assume you know USER does not deal in IRPs and filter always got a IRP created by *someone*, if you consider your trace it should be IO Manager, so there is no way you can filter an IRP before that as it is not yet created.

>I changed the target volume of the IRP, so I must change the user buf if the IRP is Rename operation.

How about creating and sending another rename IRP to target volume, once it returns, complete the original IRP?

10

> I think the running track of IRPs should be USER -> I/O Manager -> filter drivers -> file system ->

volume …

Now I need to capture the IRP before it comes to I/O manager.

IO manager in this picture generates IRPs.

The interaction between user -> IO manager does not use IRPs.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com