Paged I/O and NonPaged IO Writes

NTFSD
1

Folks,

My problem is rather basic, but I seem to be little lost. (I do not have
access to Rajeev Nagar’s book)

My goal is to trap all the writes going down. I am using IRP_NOCAHE bit to
make sure I only trap the writes to disk (not the cache). I was hoping to
trap all the writes. This works fine with notepad actually.

But when I use wordpad, I see the Irp with Flags (A00) which translate to
IRP_DEFER_IO_COMPLETION | IRP_WRITE_OPERATION. They do not have NOCACHE bit
set. I somehow never see an equivalent IRP with those info and IRP_NOCAHCE
bit set. So,I am losing some of the write information.

Is my approach wrong? I just need to make sure I do not miss any writes and
do not wish to trap IOs to cache.

Any help would be appreciated.

Best Regards
Vikas

2

Are you keying off the FILE_OBJECT? If so, you are not properly
tracking the file. Read the FAQ, particularly the discussion about
tracking file context and how to properly reference count it.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vikas Ratna
Sent: Tuesday, February 10, 2004 7:49 PM
To: ntfsd redirect
Subject: [ntfsd] Paged I/O and NonPaged IO Writes

Folks,

My problem is rather basic, but I seem to be little lost. (I do not have
access to Rajeev Nagar’s book)

My goal is to trap all the writes going down. I am using IRP_NOCAHE bit
to make sure I only trap the writes to disk (not the cache). I was
hoping to trap all the writes. This works fine with notepad actually.

But when I use wordpad, I see the Irp with Flags (A00) which translate
to IRP_DEFER_IO_COMPLETION | IRP_WRITE_OPERATION. They do not have
NOCACHE bit set. I somehow never see an equivalent IRP with those info
and IRP_NOCAHCE bit set. So,I am losing some of the write information.

Is my approach wrong? I just need to make sure I do not miss any writes
and do not wish to trap IOs to cache.

Any help would be appreciated.

Best Regards
Vikas

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

3

Tony…BINGO!

Yes, that was my folly. I am now keying it of FsContext and monitoring the
IRP_CLOSE for FO_STREAM_FILE fileobject wherein I do not decrement or remove
from list. I can now see the “ghost” IRPs:-)

The FAQ did help.

Thanks
Vikas

-----Original Message-----
Are you keying off the FILE_OBJECT? If so, you are not properly
tracking the file. Read the FAQ, particularly the discussion about
tracking file context and how to properly reference count it.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vikas Ratna
Sent: Tuesday, February 10, 2004 7:49 PM
To: ntfsd redirect
Subject: [ntfsd] Paged I/O and NonPaged IO Writes

Folks,

My problem is rather basic, but I seem to be little lost. (I do not have
access to Rajeev Nagar’s book)

My goal is to trap all the writes going down. I am using IRP_NOCAHE bit
to make sure I only trap the writes to disk (not the cache). I was
hoping to trap all the writes. This works fine with notepad actually.

But when I use wordpad, I see the Irp with Flags (A00) which translate
to IRP_DEFER_IO_COMPLETION | IRP_WRITE_OPERATION. They do not have
NOCACHE bit set. I somehow never see an equivalent IRP with those info
and IRP_NOCAHCE bit set. So,I am losing some of the write information.

Is my approach wrong? I just need to make sure I do not miss any writes
and do not wish to trap IOs to cache.

Any help would be appreciated.

Best Regards
Vikas

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@agglut.com
To unsubscribe send a blank email to xxxxx@lists.osr.com