During delayed write my filter is getting series of IRP_MJ_WRITE
notifications with process id = 8 (system) and with no file name. Only one
write operaiton contains valid file data in Irp->MdlAddress and remaining
other write IRPs contain some other data.
So is there a way to identify the IRP_MJ_WRITE that contains file data?
Regards,
VC
First, the filename field in a fileobject is only valid during DISPATCH side
processing of IRP_MJ_CREATE, you can not rely on it after this point.
Next, how are you determining that the buffer contains valid data? Are they
against the same FsContext? Paging requests can contain more data than is
represented by the EOF but this will be truncated by the FSD, notice the
Irp->IoStatus.Information on completion.
Pete
Kernel Drivers
Windows Filesystem and Device Driver Consulting
www.KernelDrivers.com
(303)546-0300
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vishnu P
Sent: Thursday, June 16, 2005 12:07 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Delayed Write
During delayed write my filter is getting series of IRP_MJ_WRITE
notifications with process id = 8 (system) and with no file name. Only one
write operaiton contains valid file data in Irp->MdlAddress and remaining
other write IRPs contain some other data.
So is there a way to identify the IRP_MJ_WRITE that contains file data?
Regards,
VC
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Im printing the data into debugger and file im filtering is 138bytes so in
one of the requests i could find the data. but im unable to get the file
name of that request
I noticed that FSD is truncating the data.
“Peter Scott” wrote in message
news:xxxxx@ntfsd…
>
> First, the filename field in a fileobject is only valid during DISPATCH
side
> processing of IRP_MJ_CREATE, you can not rely on it after this point.
>
> Next, how are you determining that the buffer contains valid data? Are
they
> against the same FsContext? Paging requests can contain more data than is
> represented by the EOF but this will be truncated by the FSD, notice the
> Irp->IoStatus.Information on completion.
>
> Pete
>
> Kernel Drivers
> Windows Filesystem and Device Driver Consulting
> www.KernelDrivers.com
> (303)546-0300
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Vishnu P
> Sent: Thursday, June 16, 2005 12:07 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Delayed Write
>
>
> During delayed write my filter is getting series of IRP_MJ_WRITE
> notifications with process id = 8 (system) and with no file name. Only one
> write operaiton contains valid file data in Irp->MdlAddress and remaining
> other write IRPs contain some other data.
>
> So is there a way to identify the IRP_MJ_WRITE that contains file data?
>
> Regards,
> VC
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
Thanx Peter
FSContext for the file when it is opened and when delay write is occures is
same. so i can compair them
“Peter Scott” wrote in message
news:xxxxx@ntfsd…
>
> First, the filename field in a fileobject is only valid during DISPATCH
side
> processing of IRP_MJ_CREATE, you can not rely on it after this point.
>
> Next, how are you determining that the buffer contains valid data? Are
they
> against the same FsContext? Paging requests can contain more data than is
> represented by the EOF but this will be truncated by the FSD, notice the
> Irp->IoStatus.Information on completion.
>
> Pete
>
> Kernel Drivers
> Windows Filesystem and Device Driver Consulting
> www.KernelDrivers.com
> (303)546-0300
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Vishnu P
> Sent: Thursday, June 16, 2005 12:07 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Delayed Write
>
>
> During delayed write my filter is getting series of IRP_MJ_WRITE
> notifications with process id = 8 (system) and with no file name. Only one
> write operaiton contains valid file data in Irp->MdlAddress and remaining
> other write IRPs contain some other data.
>
> So is there a way to identify the IRP_MJ_WRITE that contains file data?
>
> Regards,
> VC
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@kerneldrivers.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
>
Metadata maybe?
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Vishnu P”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Thursday, June 16, 2005 10:06 AM
Subject: [ntfsd] Delayed Write
>
> During delayed write my filter is getting series of IRP_MJ_WRITE
> notifications with process id = 8 (system) and with no file name. Only one
> write operaiton contains valid file data in Irp->MdlAddress and remaining
> other write IRPs contain some other data.
>
> So is there a way to identify the IRP_MJ_WRITE that contains file data?
>
> Regards,
> VC
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com