Problem when forwarding PAGING I/O to a different file

NTFSD
1

I have a mini filter driver which does some form of meta-data and data separation.

Basically, a single visible file for the end user is backed up by 2 files on disk.
All operations are forwarded to the 1st file except PAGING writes and NonCached writes.
Only PAGING writes and NonCached writes are forwarded to the 2nd file.
Other modifying operations except write (SetInfo, SetEa, SetSecurity) are also replicated to the second file.
I ensure, no one in the system can open the 2nd file except me.

I am seeing the following behavior.

  1. An Application like notepad sends a write to the file. (This being cached write is sent to the 1st file). This write also happened to be beyond the EOF.

  2. This is followed by a SetEof and SetAllocationInfo. (These are sent to both the files).

  3. Application closes the file.

All is well till this point.

Now, the Cache Manager flushes out the page.

  1. A paging write of size 4096 is sent. - This is forwarded to the 2nd file only.
  2. Followed by a setEof of 4096 - This is MY PROBLEM.

If I forward the paging write to both the files, then I see a proper set EOF (less than 4096).

Any idea what is going on?
Further, I would like to also understand what special handling needs to done for NonCached Writes (if any).

2

Basically, what dos NTFS do in the write Paging I/O path that causes the Cache Manager to send out a correct set EOF request.

3

On 9/14/2010 8:01 AM, xxxxx@yahoo.com wrote:

  1. A paging write of size 4096 is sent. - This is forwarded to the 2nd file only.
  2. Followed by a setEof of 4096 - This is MY PROBLEM.

If I forward the paging write to both the files, then I see a proper set EOF (less than 4096).

How are you forwarding the paging write request? Are you passing on the
Irp unperturbed? Or are you reallocating an Irp, etc?

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

4

I use FltWriteFile to forward the write.
I do set the corresponding flags to indicate this is a paging/non cached I/O.

Further, I set on the status and information in status block based on the results and complete the pre-write callback.