FAST_IO_QUERY_OPEN

NTFSD
1

Hi all,

Currently i am working on a mini filter implementation for Windows VISTA which requires us to change file names from what is visible to the user, then to what is physically stored on to the disc, for which we have handled following IRP’s IRP_MJ_CREATE, READ, WRITE, QUERY, DIRECTORY CONTROL and others.

The implementation works fine for the system drive, the drive on which the OS is installed (NTFS Partition), but are facing problems with the other volume which is also NTFS, after observing the IRP’s in File Spy, we found that we are getting FAST_IO_QUERY_OPEN, which seems to be failing with status set to STATUS_OBJECT_NAME_NOT_FOUND

we tried to trap FAST_IO_QUERY_OPEN in IRP_MJ_CREATE using FLT_IS_FAST_IO macro but with no success.

Any way how and where to handle this call if that cannot be done, how to disallow fast i/o’s of this kind,

I think we cannot retrieve file name in case of FAST_IO_QUERY_OPEN, usingFltGetFileNameInformation(), but may be I could be wrong here as well,

any suggestions what possible approach we can take to handle/disallow this call with out affecting the system performance

regards
Mohan Bisht

2

Are you registering to handle this? Filter manager uses a pseudo IRP_MJ
function (IRP_MJ_NETWORK_QUERY_OPEN) to uniquely represent this call, so
it is not handled via IRP_MJ_CREATE.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

3

Thanks tony,
thanks for the reply,

I was in the perception that I shall get FAST_IO_QUERY_OPEN in IRP_MJ_CREATE call back in our Mini Filter.
So just to be sure, you are suggesting that we should register a call back for IRP_MJ_NETWORK_QUERY_OPEN and if we receive a Fast I/O there just disallow the same, or I am completely wrong here.

regards
Mohan

4

You should either handle it (preferred) or disallow it. Handling it is
preferred because of all the fast I/O entry points, this is the one that
really does provide a noticeable performance gain.

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com