IRQL and major ops

NTFSD
1

My filter will sniff file operations originating from user space, e.g. MS
Office applications. All the filter needs to do is inform an app in user
space that a particular file has been opened for writing, then closed. The
user space app will then scan it for changes.

So, the filter looks for and notes IRP_MJ_CREATE and IRP_MJ_CLOSE,
*_FLUSH_BUFFERS, and the like, passing them onward untouched. Everything
else just passes through.

It is problematic to deal with code running at or above DISPATCH_LEVEL.

Can I safely discard (i.e., pass through) all major ops calls that come in
at or above DISPATCH_LEVEL, without losing data? I am not interested in page
file writes and system file updates.

Can user code (e.g., Internet Explorer) generate calls to the file system at
IRQL > DISPATCH_LEVEL?

Can a file be opened at, say, PASSIVE_LEVEL, then closed at DISPATCH_LEVEL,
or vice versa?

Does the IRQL ever change for a given file system op, as the IRP makes it’s
way through the stack? Can a file system get an IRP at PASSIVE_LEVEL, and
pass it down-stack to a SCSI disk driver at, say, DISPATCH_LEVEL?

2

IIRC the only FSD IRPs which can be sent on DISPATCH are the MDL-based
read/write IRPs with IRP_MN_DPC flag set.

Max

----- Original Message -----
From: “Eric Fowler”
To: “File Systems Developers”
Sent: Monday, November 18, 2002 1:11 AM
Subject: [ntfsd] IRQL and major ops

> My filter will sniff file operations originating from user space,
e.g. MS
> Office applications. All the filter needs to do is inform an app in
user
> space that a particular file has been opened for writing, then
closed. The
> user space app will then scan it for changes.
>
> So, the filter looks for and notes IRP_MJ_CREATE and IRP_MJ_CLOSE,
> *_FLUSH_BUFFERS, and the like, passing them onward untouched.
Everything
> else just passes through.
>
> It is problematic to deal with code running at or above
DISPATCH_LEVEL.
>
> Can I safely discard (i.e., pass through) all major ops calls that
come in
> at or above DISPATCH_LEVEL, without losing data? I am not interested
in page
> file writes and system file updates.
>
> Can user code (e.g., Internet Explorer) generate calls to the file
system at
> IRQL > DISPATCH_LEVEL?
>
> Can a file be opened at, say, PASSIVE_LEVEL, then closed at
DISPATCH_LEVEL,
> or vice versa?
>
> Does the IRQL ever change for a given file system op, as the IRP
makes it’s
> way through the stack? Can a file system get an IRP at
PASSIVE_LEVEL, and
> pass it down-stack to a SCSI disk driver at, say, DISPATCH_LEVEL?
>
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to %%email.unsub%%
>