I have a mini filter driver that intercepts files that are being written and creates a mirror file in a separate location. The mirroring is done in PreCleanupCallback(). This mirrored file is created using the flag FLTFL_IO_OPERATION_NON_CACHED, which means that the mirrored file will contain more data than the original file as the non cached operation must be done on a sector boundary. So I call FltSetInformationFile and adjust the end of file position.
This has been working pretty much for all files that are copied/saved through explorer or any other app. except for a file that I create using my test program which is of 17 bytes. When running this on windows 2003 server, I get STOP CODE 0x24.
How do I make sure that my non-cached mirrored file is of exact same length as the original file ?
Note: The test program uses std::ofstream to create the file.
How do you take care of Paging Writes on the Original File? Paging Writes can come even after Cleanup comes for that file object.
Do you simply ignore them? Try to wait till Close instead of Cleanup.
<>
Issue Paging Write to your mirrored file. The last page may contain data of length that is not a multiple of sector size. FSD will do the necessary stuff.
Thanks for your answer. Here are my clarifications:
Yes I ignore them as I register my callbacks with FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO flag.
I don’t want to do paging writes because of security reasons as I don’t want that file to live in the cache. So as I understand there is no way one can perform a non-buffered operation and yet have a file that is not sector aligned. I could probably reopen the file in cached mode just to adjust the end of file. What do you think?
Not interested in data that may be flushed by the MM? Or are you just capturing the data from the Cached Write and Non Cached Write( Excluding Paging I/O )?
<perform a non-buffered operation and yet have a file that is not sector aligned.>>
Paging I/O is a Non Cached I/O.
<What do you think?>> Ya, you can do this. But is you are opening the file in cached mode at a later stage, why not do it in the beginning itself?
Yes, I am just capturing cached and non cached write. Now, I am a bit confused here, you say Paging I/O is a non Cached I/O then why there are two flags FLT_IO_OPERATION_NON_CACHED and FLT_IO_OPERATION_PAGING?
If I create the file with the flag FILE_NO_INTERMEDIATE_BUFFERING then I must use FLT_IO_OPERATION_NON_CACHED with read/write apis. Correct? Are you suggesting to use FLT_IO_OPERATION_PAGING with read/writes?
<1. I can get away with FILE_NO_INTERMEDIATE_BUFFERING flag, and 2. Do not require to allocate buffer using FltAllocatePoolAligned()>>
NO. As I told before, the FSD honors unaligned writes to a file ONLY in case of PAGING WRITE. PAGING I/O is a special case of NON CACHED I/O. You have to issue paging writes for writing unaligned data; NOT THE NORMAL non cached writes.
<>
Issuing Paging Writes is NOT simply a matter of changing flags. You have to do more for it.
Let me tell you the best part, simply open the file in cached mode and write unaligned writes.
