completing IRP_MJ_READ in file system filter driver

NTFSD
1

I am developing a file system filter driver, in which i am trapping the read
and satisfy that from mine file and not from default file for which it is
heading to.
The approach i am using is

  1. blocking the orignal IRP_MJ_READ
  2. figure out which file i have to read then open/read/close that file and
    copies the data in userbuffer/MdlAddress in case its not paging I/O
  3. setting iostatus
  4. completing the IRP_MJ_READ

but the problem i am facing is that in case of paging I/O

  1. we can’t generate page-faults, which mine code is generating as i
    open/read/close some other file after blocking the main request.
  2. Also if i am sending irp-pending up then creating a worker thread to
    open/read/close file from mine drive, Then the major problem is where to
    copy the data, as its an paging I/O, i guess its the duty of FSD to allocate
    page-align memory for that, associate that memory with fileobject. (Not
    clear to me)
    So how do i read the data in case of paging I/O suggestions, coz i think i
    can non-pagingl IRP_MJ_READ but can’t live without Paging I/O, so if i have
    to implement the memory allocation and association then please give some
    hints.

Thanks in advance
=vikramsingh

2

I suggest trapping the IRP_MJ_CREATE call and open your secondary file then.
When you get the IRP_MJ_READ request, you can determine which file to return
the data from (original vs. “mine” file). When you get eh IRP_MJ_CLEANUP and
the IRP_MJ_CLOSE calls, act accordingly with your “mine” file.

What you are trying to do now is handle the create/read/cleanup and close
calls during the read operation and that is going to be problematic; not to
mention to severe performance degradation you will encounter if you do
manage to get it working.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of vikram singh
Sent: Monday, January 24, 2005 11:05 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] completing IRP_MJ_READ in file system filter driver

I am developing a file system filter driver, in which i am trapping the read
and satisfy that from mine file and not from default file for which it is
heading to.
The approach i am using is

  1. blocking the orignal IRP_MJ_READ
  2. figure out which file i have to read then open/read/close that file and
    copies the data in userbuffer/MdlAddress in case its not paging I/O
  3. setting iostatus
  4. completing the IRP_MJ_READ

but the problem i am facing is that in case of paging I/O

  1. we can’t generate page-faults, which mine code is generating as i
    open/read/close some other file after blocking the main request.
  2. Also if i am sending irp-pending up then creating a worker thread to
    open/read/close file from mine drive, Then the major problem is where to
    copy the data, as its an paging I/O, i guess its the duty of FSD to allocate
    page-align memory for that, associate that memory with fileobject. (Not
    clear to me)
    So how do i read the data in case of paging I/O suggestions, coz i think i
    can non-pagingl IRP_MJ_READ but can’t live without Paging I/O, so if i have
    to implement the memory allocation and association then please give some
    hints.

Thanks in advance
=vikramsingh

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@tfb.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________ NOD32 1.981 (20050125) Information __________

This message was checked by NOD32 antivirus system.
http://www.nod32.com

3

> I suggest trapping the IRP_MJ_CREATE call

and open your secondary file then.

Agreed. I only note that the easiest way is to use reparsing
(look for STATUS_REPARSE in the MSDN, you should
like the official documentation how to do this.

L.

4

Yes, but reparsing will not leave the original file open. So, I guess the
posters requirements should be more clearly defined.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Wednesday, January 26, 2005 12:43 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] completing IRP_MJ_READ in file system filter driver

I suggest trapping the IRP_MJ_CREATE call
and open your secondary file then.

Agreed. I only note that the easiest way is to use reparsing
(look for STATUS_REPARSE in the MSDN, you should
like the official documentation how to do this.

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@tfb.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________ NOD32 1.982 (20050125) Information __________

This message was checked by NOD32 antivirus system.
http://www.nod32.com