Network write operation!

NTFSD
1

Hi,
I would like to hook on paging io write operation. Can someone please
explain why some apps (e.g. Winzip) do not cause paging io write? I only
notice normal write operation when it is modified across Microsoft network
drive.

I also notice (using filemon) most of the applications have paging io write
when their data is modified across the network. However, when my driver is
attached, I simply pass through the write operation to the lower driver.
This time I don’t see any paging io write. For example, I modify a bitmap
file with and without my driver attached. The output from filemon is shown
below:
What cause this different behavior? Any information is appreciated.

Regards,
Sin-Lam

=======================================================================
No driver attached

IRP_MJ_CREATE K:\decrypt\setup.bmp SUCCESS Attributes: Any Options: Open
FASTIO_QUERY_BASIC_INFO K:\decrypt\setup.bmp FAILURE
IRP_MJ_QUERY_INFORMATION K:\decrypt\setup.bmp SUCCESS FileBasicInformation
IRP_MJ_CLEANUP K:\decrypt\setup.bmp SUCCESS
IRP_MJ_CLOSE K:\decrypt\setup.bmp SUCCESS
IRP_MJ_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 14
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 4096
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 14
Length: 104
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 14 Length: 104
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 118
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 16384 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 118 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 16502
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 32768 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 16502 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 32886
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 49152 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 32886 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 49270
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 65536 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 49270 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 65654
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 81920 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 65654 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 82038
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 98304 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 82038 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 98422
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 114688 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 98422 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 114806
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 131072 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 114806 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 131190
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 147456 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 131190 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 147574
Length: 6144
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 151552 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 147574 Length: 6144
IRP_MJ_FLUSH K:\decrypt\setup.bmp SUCCESS
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 65536
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 65536 Length: 65536
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 131072 Length: 24576

With my driver attached

IRP_MJ_CREATE K:\BlockSwap\setup.bmp SUCCESS Attributes: Any Options: Open
FASTIO_QUERY_BASIC_INFO K:\BlockSwap\setup.bmp FAILURE
IRP_MJ_QUERY_INFORMATION K:\BlockSwap\setup.bmp SUCCESS FileBasicInformation
IRP_MJ_CLEANUP K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_CLOSE K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 0 Length: 14
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 14 Length: 104
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 118 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 16502 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 32886 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 49270 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 65654 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 82038 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 98422 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 114806 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 131190 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 147574 Length: 6144
IRP_MJ_FLUSH K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_READ K:\BlockSwap\setup.bmp SUCCESS Offset: 153712 Length: 16
IRP_MJ_SET_INFORMATION K:\BlockSwap\setup.bmp SUCCESS
FileEndOfFileInformation
IRP_MJ_SET_INFORMATION K:\BlockSwap\setup.bmp SUCCESS
FileAllocationInformation
IRP_MJ_CLEANUP K:\BlockSwap\setup.bmp SUCCESS

2

Sin-Lam:

Your trace suggests you are disabling caching in some fashion. Notice that
you don’t see a paging read on that initial 14 byte write? This suggests
either (a) the data is already in the cache (in which case it wouldn’t need
to read the page) or (b) the data is not being cached. The latter doesn’t
make sense to me since it is a 14 byte write and the file system should
reject it.

Of course, it is also clear there are I/O operations not presented in your
traces, so there may be something that happened that I’m missing here. Note
that we see a CREATE/QUERY/CLEANUP/CLOSE and then we observe read/write
against the same file - this suggests there’s an open object already for the
file, but that’s not shown on (either) of the traces.

Maybe someone else can see something here, but I think you may be focusing
on a subset of the interesting I/O operations here and missing something,
either before or after this trace.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: Tan Sin Lam [mailto:xxxxx@lit.org.sg]
Sent: Saturday, March 23, 2002 6:29 AM
To: File Systems Developers
Subject: [ntfsd] Network write operation!

Hi,
I would like to hook on paging io write operation. Can someone please
explain why some apps (e.g. Winzip) do not cause paging io write? I only
notice normal write operation when it is modified across Microsoft network
drive.

I also notice (using filemon) most of the applications have paging io write
when their data is modified across the network. However, when my driver is
attached, I simply pass through the write operation to the lower driver.
This time I don’t see any paging io write. For example, I modify a bitmap
file with and without my driver attached. The output from filemon is shown
below:
What cause this different behavior? Any information is appreciated.

Regards,
Sin-Lam

=======================================================================
No driver attached

IRP_MJ_CREATE K:\decrypt\setup.bmp SUCCESS Attributes: Any Options: Open
FASTIO_QUERY_BASIC_INFO K:\decrypt\setup.bmp FAILURE
IRP_MJ_QUERY_INFORMATION K:\decrypt\setup.bmp SUCCESS FileBasicInformation
IRP_MJ_CLEANUP K:\decrypt\setup.bmp SUCCESS
IRP_MJ_CLOSE K:\decrypt\setup.bmp SUCCESS
IRP_MJ_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 14
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 4096
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 14
Length: 104
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 14 Length: 104
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 118
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 16384 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 118 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 16502
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 32768 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 16502 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 32886
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 49152 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 32886 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 49270
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 65536 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 49270 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 65654
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 81920 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 65654 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 82038
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 98304 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 82038 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 98422
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 114688 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 98422 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 114806
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 131072 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 114806 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 131190
Length: 16384
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 147456 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 131190 Length: 16384
FASTIO_CHECK_IF_POSSIBLE K:\decrypt\setup.bmp SUCCESS Write: Offset: 147574
Length: 6144
IRP_MJ_READ* K:\decrypt\setup.bmp SUCCESS Offset: 151552 Length: 4096
FASTIO_WRITE K:\decrypt\setup.bmp SUCCESS Offset: 147574 Length: 6144
IRP_MJ_FLUSH K:\decrypt\setup.bmp SUCCESS
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 0 Length: 65536
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 65536 Length: 65536
IRP_MJ_WRITE* K:\decrypt\setup.bmp SUCCESS Offset: 131072 Length: 24576

With my driver attached

IRP_MJ_CREATE K:\BlockSwap\setup.bmp SUCCESS Attributes: Any Options: Open
FASTIO_QUERY_BASIC_INFO K:\BlockSwap\setup.bmp FAILURE
IRP_MJ_QUERY_INFORMATION K:\BlockSwap\setup.bmp SUCCESS FileBasicInformation
IRP_MJ_CLEANUP K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_CLOSE K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 0 Length: 14
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 14 Length: 104
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 118 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 16502 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 32886 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 49270 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 65654 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 82038 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 98422 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 114806 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 131190 Length: 16384
IRP_MJ_WRITE K:\BlockSwap\setup.bmp SUCCESS Offset: 147574 Length: 6144
IRP_MJ_FLUSH K:\BlockSwap\setup.bmp SUCCESS
IRP_MJ_READ K:\BlockSwap\setup.bmp SUCCESS Offset: 153712 Length: 16
IRP_MJ_SET_INFORMATION K:\BlockSwap\setup.bmp SUCCESS
FileEndOfFileInformation
IRP_MJ_SET_INFORMATION K:\BlockSwap\setup.bmp SUCCESS
FileAllocationInformation
IRP_MJ_CLEANUP K:\BlockSwap\setup.bmp SUCCESS

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%

3

Hi Tony,
Thank you for the helpful information. You are right, I disabled caching
in network read operation sometimes ago and I forgot about that. After
reading your message, I searched my code for the flag and found it.
Everything goes as normal after I enable that flag.

I still don’t understand why there is no paging io write, when I open a
zip file across the network redirector and add a file into the zip file,
there is no paging io write, only normal write operation. This happened
without my driver loaded. The minor function and DeviceObject’s flag for
IRP_MJ_WRITE are both zero. The zip file in the server is actually updated.
Is this normal for network operation without paging io write? Any suggestion
is appreciated.

Regards,
Sin-Lam

Sin-Lam:

Your trace suggests you are disabling caching in some fashion. Notice
that
you don’t see a paging read on that initial 14 byte write? This suggests
either (a) the data is already in the cache (in which case it wouldn’t
need
to read the page) or (b) the data is not being cached. The latter doesn’t
make sense to me since it is a 14 byte write and the file system should
reject it.

Of course, it is also clear there are I/O operations not presented in your
traces, so there may be something that happened that I’m missing here.
Note
that we see a CREATE/QUERY/CLEANUP/CLOSE and then we observe read/write
against the same file - this suggests there’s an open object already for
the
file, but that’s not shown on (either) of the traces.

Maybe someone else can see something here, but I think you may be focusing
on a subset of the interesting I/O operations here and missing something,
either before or after this trace.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

4

I don’t know, if this is right reason for your problem, but by my
experience, LanMan doesn’t permit any paging-io write/read if the
file wasn’t opened with FILE_WRITE/FILE_READ access right.
This behaviour is different from that of disk FS’s and it concern
me why. I think, it is according to security checks on server
side?

Ondra.

?ena v centru pozornosti na http://zena.centrum.cz