These are pseudo operations invented by filter manager and used in the
registration and callback interface.
None of them are tied to any specific Win32 API - they all represent
internal operations of the OS and various kernel mode components (so
you’d have a tough time building Win32 apps.)
The first four are related to memory manager callbacks (basically,
locking the file to ensure it doesn’t change while performing paging I/O
operations.)
Stream file objects today have nothing to do with “streams” per-se
although that was likely the original motivation. See
IoCreateStreamFileObject, IoCreateStreamFileObjectLite, and
IoCreateStreamFileObjectEx for information about these functions; the
callback here is associated with the stream file object creation (note
that it doesn’t detect those folks who directly create their own file
objects, so you STILL have to be prepared to deal with that case as
well.)
MDL operations are used by AFD and SRV to directly retrieve MDLs of the
file data in cache - thus there is an MDL read and a prepare MDL write
and then two functions representing the release of the MDLs.
I think you can see demonstrations of all these in the IFS Kit file
system examples.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Tuesday, July 25, 2006 12:58 PM
To: ntfsd redirect
Subject: [ntfsd] Information on undocumented Irps
After looking at the passthrough exemple that is include in the IFS kit,
I have seen some Irps that even google know nothing about! Now of course
I *could* make my own filter and try to figure out when these irps are
generated, what win32 api causes them to be generated and what they do,
but i figure I’d ask around in the community first to see if anyone has
allready done the research 
IRP_MJ_ACQUIRE_FOR_MOD_WRITE / IRP_MJ_RELEASE_FOR_MOD_WRITE
Is this for transaction based write as part of of NTFS Recoverable file
system support?
IRP_MJ_ACQUIRE_FOR_CC_FLUSH / IRP_MJ_RELEASE_FOR_CC_FLUSH
Again, another wild guess, but is this used by the cache manager to lock
dirty pages in order to flush them to disk?
IRP_MJ_NOTIFY_STREAM_FILE_OBJECT
I’m guessing this has to do with NTFS streams… notifies a stream was
created maybe?
IRP_MJ_MDL_READ_COMPLETE
Completed Fast IO Asynchronous read?
IRP_MJ_PREPARE_MDL_WRITE
???
IRP_MJ_MDL_WRITE_COMPLETE
Completed fast IO Asynchronous write?
Thanks for any info you guys can provide!
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com