I know as part of the registration a mini-filter can specify whether to
skip cached I/O or not, but is there an easy way to detect that a request
is cached I/O if you do not specify skiping them? Maybe its because it is
Monday, but I figured there would be, but sure cannot see it at the moment.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
I was thinking of trying this by checking to see if the IRP_NOCACHE flag is set in
Data->Iopb->IrpFlags. The IFSK.chm file says this represents a “noncached I/O operation.”
Thanks I knew it was simple, Monday really does strike again.
Don Burn
wrote in message news:xxxxx@ntfsd…
>I was thinking of trying this by checking to see if the IRP_NOCACHE flag
>is set in
> Data->Iopb->IrpFlags. The IFSK.chm file says this represents a
> “noncached I/O operation.”
>
>
But, Don, how do you know, just because the IRP does not say please dont do
with me in the cache, it is done with in the cache (do/done = read/read,
write/written), mini-filter, or otherwise?
“Don Burn” wrote in message news:xxxxx@ntfsd…
>I know as part of the registration a mini-filter can specify whether to
>skip cached I/O or not, but is there an easy way to detect that a request
>is cached I/O if you do not specify skiping them? Maybe its because it is
>Monday, but I figured there would be, but sure cannot see it at the moment.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
>
>
>
>
Lyndon,
Really I want to know the I/O that comes from the cache manager for a
file opened cached. I won’t swear to this, but I would assume that the
NO_CACHE flag is a reasonable indicator of such I/O.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
“Lyndon J. Clarke” wrote in message
news:xxxxx@ntfsd…
> But, Don, how do you know, just because the IRP does not say please dont
> do with me in the cache, it is done with in the cache (do/done =
> read/read, write/written), mini-filter, or otherwise?
>
> “Don Burn” wrote in message news:xxxxx@ntfsd…
>>I know as part of the registration a mini-filter can specify whether to
>>skip cached I/O or not, but is there an easy way to detect that a request
>>is cached I/O if you do not specify skiping them? Maybe its because it
>>is Monday, but I figured there would be, but sure cannot see it at the
>>moment.
>>
>>
>> –
>> Don Burn (MVP, Windows DDK)
>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> http://www.windrvr.com
>>
>>
>>
>>
>
>
>
> I want to know the I/O that comes from the cache manager for a file opened
cached.
Actually such IRPs come from the Memory Manager. The Cache Manager tells the
Memory Manager to send IRPs( explicitly or through the page faults ). The
IRPs sent by the Memory Manager have the NO_CACHE flag in any case.
–
Slava Imameyev, xxxxx@hotmail.com
“Don Burn” wrote in message news:xxxxx@ntfsd…
> Lyndon,
>
> Really I want to know the I/O that comes from the cache manager for a
> file opened cached. I won’t swear to this, but I would assume that the
> NO_CACHE flag is a reasonable indicator of such I/O.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
>
>
>
> “Lyndon J. Clarke” wrote in message
> news:xxxxx@ntfsd…
>> But, Don, how do you know, just because the IRP does not say please dont
>> do with me in the cache, it is done with in the cache (do/done =
>> read/read, write/written), mini-filter, or otherwise?
>>
>> “Don Burn” wrote in message news:xxxxx@ntfsd…
>>>I know as part of the registration a mini-filter can specify whether to
>>>skip cached I/O or not, but is there an easy way to detect that a request
>>>is cached I/O if you do not specify skiping them? Maybe its because it
>>>is Monday, but I figured there would be, but sure cannot see it at the
>>>moment.
>>>
>>>
>>> –
>>> Don Burn (MVP, Windows DDK)
>>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>>> http://www.windrvr.com
>>>
>>>
>>>
>>>
>>
>>
>>
>
>
>
Err, the cache manager also sends IRPs when it needs data. NO_CACHE & PAGING_IO
is a good enough indicator for this.
Slava Imameyev wrote:
> I want to know the I/O that comes from the cache manager for a file opened
> cached.Actually such IRPs come from the Memory Manager. The Cache Manager tells the
Memory Manager to send IRPs( explicitly or through the page faults ). The
IRPs sent by the Memory Manager have the NO_CACHE flag in any case.
–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.
Hi Don
Ah so you want distinguish the i/o from cc/mm to ‘storage’, in other words
the paging i/o? In that case you want to check the Irp Flags for
IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO. I’d misread your post and
assumed you wanted to distinguish the i/o to cc/mm from ‘application’; an
old chestnut 
Cheers
Lyndon
“Don Burn” wrote in message news:xxxxx@ntfsd…
> Lyndon,
>
> Really I want to know the I/O that comes from the cache manager for a
> file opened cached. I won’t swear to this, but I would assume that the
> NO_CACHE flag is a reasonable indicator of such I/O.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
>
>
>
> “Lyndon J. Clarke” wrote in message
> news:xxxxx@ntfsd…
>> But, Don, how do you know, just because the IRP does not say please dont
>> do with me in the cache, it is done with in the cache (do/done =
>> read/read, write/written), mini-filter, or otherwise?
>>
>> “Don Burn” wrote in message news:xxxxx@ntfsd…
>>>I know as part of the registration a mini-filter can specify whether to
>>>skip cached I/O or not, but is there an easy way to detect that a request
>>>is cached I/O if you do not specify skiping them? Maybe its because it
>>>is Monday, but I figured there would be, but sure cannot see it at the
>>>moment.
>>>
>>>
>>> –
>>> Don Burn (MVP, Windows DDK)
>>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>>> http://www.windrvr.com
>>>
>>>
>>>
>>>
>>
>>
>>
>
>
>
> Err, the cache manager also sends IRPs when it needs data. NO_CACHE &
PAGING_IO
is a good enough indicator for this.
The Cache Manager uses memory mapping the file and calls Mm***( i.e. the
Memory Manager ) functions or reads/writes memory mapping the file( i.e.
generates page faults that are processed by the Memory Manager ) it never
calls IoPageRead or creates IRPs to fill the pages, the same for the write -
MmFlushSection is used! The Memory Manager sets the IRP_NO_CACHE flag for
all read/write paging IRPs.
–
Slava Imameyev, xxxxx@hotmail.com
“Dejan Maksimovic” wrote in message news:xxxxx@ntfsd…
>
> Err, the cache manager also sends IRPs when it needs data. NO_CACHE &
> PAGING_IO
> is a good enough indicator for this.
>
> Slava Imameyev wrote:
>
>> > I want to know the I/O that comes from the cache manager for a file
>> > opened
>> > cached.
>>
>> Actually such IRPs come from the Memory Manager. The Cache Manager tells
>> the
>> Memory Manager to send IRPs( explicitly or through the page faults ). The
>> IRPs sent by the Memory Manager have the NO_CACHE flag in any case.
>
> –
> King regards, Dejan
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>
I knew I missed something 
(sync flag, not just pg)
“Lyndon J. Clarke” wrote:
Hi Don
Ah so you want distinguish the i/o from cc/mm to ‘storage’, in other words
the paging i/o? In that case you want to check the Irp Flags for
IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO. I’d misread your post and
assumed you wanted to distinguish the i/o to cc/mm from ‘application’; an
old chestnut
–
King regards, Dejan
http://www.alfasp.com
File system audit, security and encryption kits.