FILE_NO_INTERMEDIATE_BUFFERING question

NTFSD
1

Hi,

In user mode I open a existed file with overwritten without buffering, then write the 16 bytes to the file.

In write IRP, I saw that the writes with IRP_NOCACHE set in offset 0, length 64k from my test program, it looks correct.

but after a few seconds, I saw that another write IRP with the same file with offset 0,length 4096 with IRP_PAGING_IO set from system process, this doesn’t make sense.

why I see this pagingIo from system? My write didn’t go to the cache, anyone can explain this?

Thanks
Mike

2

if you really create/open file with FILE_NO_INTERMEDIATE_BUFFERING - you must got STATUS_INVALID_PARAMETER when try write the 16 bytes to the file, because “The Length passed to ZwReadFile or ZwWriteFile must be an integral of the sector size”. so faster you not open file with FILE_NO_INTERMEDIATE_BUFFERING at all

3

Sorry, My description is not correct, I do need to write the 16 bytes data, the steps are:

  1. Open the file with CREATE_ALWAYS and FILE_NO_INTERMEDIATE_BUFFERING .
  2. Allocated 64kb buffer, write 16bytes data to the buffer, and write it to the file
  3. Then set the file size to 16 bytes, then close the handle.

If I only test with above steps , I will only see one NO_CACHE write. But in my test case, before these steps, the file was created and written data first and close the handle, then follow the above test steps, I will see two write request, one is NO_CACHE write, then with PAGING_IO write.

Thanks
Mike

4

I cannot understand what is the need in FILE_NO_INTERMEDIATE_BUFFERING if you just need to write 16 bytes to a newly created file.

Just do this the simplest possible way, using the most standard parameters to ZwCreateFile.

–
Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntfsd…
> Sorry, My description is not correct, I do need to write the 16 bytes data, the steps are:
>
> 1. Open the file with CREATE_ALWAYS and FILE_NO_INTERMEDIATE_BUFFERING .
> 2. Allocated 64kb buffer, write 16bytes data to the buffer, and write it to the file
> 3. Then set the file size to 16 bytes, then close the handle.
>
> If I only test with above steps , I will only see one NO_CACHE write. But in my test case, before these steps, the file was created and written data first and close the handle, then follow the above test steps, I will see two write request, one is NO_CACHE write, then with PAGING_IO write.
>
> Thanks
> Mike
>

5

Sure because first the existing cache need to be flushed and purged off and
then the no cache write came along.
There is nothing unusual as far as I can see. You may even see more than
one write depending on the situation just on the the open. Anyway, still I
do not understand exactly your inquiry. This is just the way the FSD along
with Cc work. For more details around this flag read its documentation and
grep the fastfat sample for this flag and see how it deals with it.
Good luck.

Gabriel
www.kasardia.com

On Fri, Jun 17, 2016 at 5:21 PM, Maxim S. Shatskih
wrote:

> I cannot understand what is the need in FILE_NO_INTERMEDIATE_BUFFERING
> if you just need to write 16 bytes to a newly created file.
>
> Just do this the simplest possible way, using the most standard
> parameters to ZwCreateFile.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> wrote in message news:xxxxx@ntfsd…
> > Sorry, My description is not correct, I do need to write the 16 bytes
> data, the steps are:
> >
> > 1. Open the file with CREATE_ALWAYS and FILE_NO_INTERMEDIATE_BUFFERING .
> > 2. Allocated 64kb buffer, write 16bytes data to the buffer, and write it
> to the file
> > 3. Then set the file size to 16 bytes, then close the handle.
> >
> > If I only test with above steps , I will only see one NO_CACHE write.
> But in my test case, before these steps, the file was created and written
> data first and close the handle, then follow the above test steps, I will
> see two write request, one is NO_CACHE write, then with PAGING_IO write.
> >
> > Thanks
> > Mike
> >
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
>

–
Bercea. G.</http:>

6

Did you read the comments in MDSN re the FILE_FLAG_NO_BUFFERING flag?

https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx

there is even a sub article that describes the finer points

https://msdn.microsoft.com/en-us/library/windows/desktop/cc644950(v=vs.85).aspx

Sent from Mailhttps: for Windows 10

From: xxxxx@hotmail.commailto:xxxxx
Sent: June 16, 2016 4:46 PM
To: Windows File Systems Devs Interest Listmailto:xxxxx
Subject: [ntfsd] FILE_NO_INTERMEDIATE_BUFFERING question

Hi,

In user mode I open a existed file with overwritten without buffering, then write the 16 bytes to the file.

In write IRP, I saw that the writes with IRP_NOCACHE set in offset 0, length 64k from my test program, it looks correct.

but after a few seconds, I saw that another write IRP with the same file with offset 0,length 4096 with IRP_PAGING_IO set from system process, this doesn’t make sense.

why I see this pagingIo from system? My write didn’t go to the cache, anyone can explain this?

Thanks
Mike

—
NTFSD is sponsored by OSR

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></mailto:xxxxx></mailto:xxxxx></https:>