The meaning of 2 Write IRP's for each file write operation

NTFSD
1

Hello!

I have noticed that every time a write operation occurs, two Write IRP’s are send.

I tried it on a small TXT file, and when I saved it, having only 3 characters in it, the first Write IRP was writing 3 bytes to the file, and the second Write IRP was writing 4096 bytes to the file.

What does it mean? Why are there 2 IRP’s and what’s the meaning of the data size to be written?

Thanks!

2

The first write was the application writing the 3 characters, and the second
write was the cache manager writing the sector to disk.

----- Original Message -----
From:
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, October 10, 2007 9:11 AM
Subject: [ntfsd] The meaning of 2 Write IRP’s for each file write operation

> Hello!
>
> I have noticed that every time a write operation occurs, two Write IRP’s
> are send.
>
> I tried it on a small TXT file, and when I saved it, having only 3
> characters in it, the first Write IRP was writing 3 bytes to the file, and
> the second Write IRP was writing 4096 bytes to the file.
>
> What does it mean? Why are there 2 IRP’s and what’s the meaning of the
> data size to be written?
>
> Thanks!
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> You are currently subscribed to ntfsd as: xxxxx@netlib.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

3

Is there any way to distinguish between them in a filter driver?

4

Read the FAQ and this newsgroup. Use the web interface search function.

wrote in message news:xxxxx@ntfsd…
> Is there any way to distinguish between them in a filter driver?
>

5

Thanks!

6

I found out that they have different IRP Flags. But how can I access these flags?

7

Via Irp->Flags?

xxxxx@gmail.com wrote:

I found out that they have different IRP Flags. But how can I access these flags?

–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

8

you should look at the toplevelirp
if the file is memory mapped the application will commit only the modified page

9

Look at the bits in the irp. 1 of the writes is a paging write.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, October 10, 2007 9:12 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] The meaning of 2 Write IRP’s for each file write operation

Hello!

I have noticed that every time a write operation occurs, two Write IRP’s are send.

I tried it on a small TXT file, and when I saved it, having only 3 characters in it, the first Write IRP was writing 3 bytes to the file, and the second Write IRP was writing 4096 bytes to the file.

What does it mean? Why are there 2 IRP’s and what’s the meaning of the data size to be written?

Thanks!

NTFSD is sponsored by OSR

For our schedule debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

You are currently subscribed to ntfsd as: xxxxx@gmail.com
To unsubscribe send a blank email to xxxxx@lists.osr.com