FSCTL_OFFLOAD_WRITE: getting file change offsets for offloaded data transfers

NTFSD
1

Hi,

I am writing a file system filter driver to intercept the writes to a file. I have handled IRP_MJ_WRITE to obtain the offset and length when a file is being modified.


Also, I have handled the minor function code FSCTL_OFFLOAD_WRITE for the major function code IRP_MJ_FILE_SYSTEM_CONTROL to intercept offloaded writes. The intention is to obtain the offset and lengths for the changes that happen to the file during offloaded data transfer. However, I am not able to find any data structure/member which will give offset and length. FSCTL_OFFLOAD_WRITE is accompanied by FSCTL_OFFLOAD_WRITE_INPUT and FSCTL_OFFLOAD_WRITE_OUTPUT but they appear to be for initiating the ODX operation in conjunction with FSCTL_OFFLOAD_READ and do not appear to be related to FLT_PARAMETERS::FileSystemControl::Buffered that is available on intercepting IRP_MJ_FILE_SYSTEM_CONTROL.


Given that, I am now wondering if Microsoft provided minor function code FSCTL_OFFLOAD_WRITE in major function code IRP_MJ_FILE_SYSTEM_CONTROL, only to give file system filter drivers a right of first refusal in case they want to explicitly block offloaded data transfers. Perhaps, providing the offset and lengths was never the intention? And if it is indeed true, then I am not sure where and how can I obtain the offset and length for the changes that happen within a file on ODX operations.


Highly appreciate any help/advice on how I could possibly obtain the offsets and lengths for offloaded data transfers.


Thanks in advance,
Mandar


Ref:
ODX Considerations for Filter Drivers: https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/offloaded-data-transfers#considerations-for-filter-drivers
ODX usage in HyperV/MSSQL: https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cifs-hypv-sql%2FGUID-EB7F329D-8E3D-436A-B999-BBB125677271.html

2

Aren’t FileOffset and CopyLength what you’re looking for? Or are you trying to see the data as well?

3

Hi Scott,


Thanks for the reply.


Yes, those are the values that I am interested in. Due to oversight, I had missed the fact that the FSCTL_OFFLOAD_WRITE_INPUT is provided through the FLT_PARAMETERS::FileSystemControl::Buffered::SystemBuffer member and it needs to be reinterpreted back to FSCTL_OFFLOAD_WRITE_INPUT to obtain the necessary offset and length. So I think I am good for now.


Thanks,
Mandar