how should i issue read request to a memory mapped file in my FS filter driver?

NTFSD
1

Hi!

  1. How should i issue read request to a memory mapped file in its IRP_MJ_WRITE.
    Basically i want to read the contents of the original file (memory mapped) just before its modification( by IRP_MJ_WRITE).

  2. What are the issues that i should consider?

2

>How should i issue read request to a memory mapped file in its
IRP_MJ_WRITE.

Create an IRP and send it to an underlying driver.
You must consider two cases

  1. A file object is retrieved from the IRP_MJ_WRITE IRP. This file object
    may be in a cleanup state, so you must send a Paging IO request. But a
    completion of the paging IO requests is not documented and differs from the
    completion of an ordinary IRP.
  2. You use a file object that has been opened by your filter and you have a
    valid handle for it. In that case you can use a non paging read request( as
    described in the DDK for
    IoBuildAsynchronousFsdRequest/IoBuildSynchronousFsdRequest ). I suggest to
    send this request from a worker thread.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> Hi!
>
> 1) How should i issue read request to a memory mapped file in its
> IRP_MJ_WRITE.
> Basically i want to read the contents of the original file (memory mapped)
> just before its modification( by IRP_MJ_WRITE).
>
> 2) What are the issues that i should consider?
>

3

If IoGetTopLevelIrp() != NULL then send request in the context of the
caller, else you can use a worker thread.

–
Slava Imameyev, xxxxx@hotmail.com

“Slava Imameyev” wrote in message news:xxxxx@ntfsd…
> >How should i issue read request to a memory mapped file in its
> IRP_MJ_WRITE.
>
> Create an IRP and send it to an underlying driver.
> You must consider two cases
> 1) A file object is retrieved from the IRP_MJ_WRITE IRP. This file object
> may be in a cleanup state, so you must send a Paging IO request. But a
> completion of the paging IO requests is not documented and differs from
> the completion of an ordinary IRP.
> 2) You use a file object that has been opened by your filter and you have
> a valid handle for it. In that case you can use a non paging read
> request( as described in the DDK for
> IoBuildAsynchronousFsdRequest/IoBuildSynchronousFsdRequest ). I suggest to
> send this request from a worker thread.
>
>
> –
> Slava Imameyev, xxxxx@hotmail.com
>
>
> wrote in message news:xxxxx@ntfsd…
>> Hi!
>>
>> 1) How should i issue read request to a memory mapped file in its
>> IRP_MJ_WRITE.
>> Basically i want to read the contents of the original file (memory
>> mapped) just before its modification( by IRP_MJ_WRITE).
>>
>> 2) What are the issues that i should consider?
>>
>
>
>

4

> 1) A file object is retrieved from the IRP_MJ_WRITE IRP. This file object

may be in a cleanup state, so you must send a Paging IO request. But a
completion of the paging IO requests is not documented and differs from the
completion of an ordinary IRP.

If you intercept this via the completion routine and return
STATUS_MORE_PROCESSING_REQUIRED - then all is documented and simple, your
completion is called, and nothing else :slight_smile:

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

5

> If you intercept this via the completion routine and return

STATUS_MORE_PROCESSING_REQUIRED - then all is >documented and simple

Yes, this will work on all current kernels.
How to build a paging IRP we discussed a month ago( allocating IRP,
initializing it, completion ). Posts “How roll my IRP for paging IO?” and
“How can I write the file byte range locked?”.
But I think MS discourages a building of paging IRPs.

–
Slava Imameyev, xxxxx@hotmail.com

“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
>> 1) A file object is retrieved from the IRP_MJ_WRITE IRP. This file
>> object
>> may be in a cleanup state, so you must send a Paging IO request. But a
>> completion of the paging IO requests is not documented and differs from
>> the
>> completion of an ordinary IRP.
>
> If you intercept this via the completion routine and return
> STATUS_MORE_PROCESSING_REQUIRED - then all is documented and simple, your
> completion is called, and nothing else :slight_smile:
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>

6

Thanks for ur replies!!
Just one thing… I need to ensure that the read request issued by the filter driver completes before the write request to that file. What are the issues that i should consider?

7

> I need to ensure that the read request issued by the filter driver

completes before the write request to that file.

Do not worry, you are going to send a synchronous request. It completes
before you pass through the write request.

–
Slava Imameyev, xxxxx@hotmail.com

wrote in message news:xxxxx@ntfsd…
> Thanks for ur replies!!
> Just one thing… I need to ensure that the read request issued by the
> filter driver completes before the write request to that file. What are
> the issues that i should consider?
>