Under the hood - IRP_MN_MDl

NTFSD
1

What happens under during IRP_MN_MDL processing? (I mean in the
cache manager not the file system).
For read, I assume, CcMdlRead reads the data, and returns and MDL to
it - CcMdlReadComplete just releases the pages…
CcPrepareMdlWrite - now this I am not sure of… Does it read the
data into the MDLs first, and then returns the MDL, or does it just
assume that the caller will fill the entire range he asked for, and the
rest is zero (i.e. is the region zero initialized)?

TIA.
To MS: it would be nice to have this and similar information
provided with the IFS Kit. While for a file system, the description is
sufficient, a filter driver needs more to know what to do.

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32
developers.
Alfa File Monitor - File monitoring library for Win32 developers.

2

>For read, I assume, CcMdlRead reads the data, and returns and MDL to

it - CcMdlReadComplete just releases the pages…

Not necessarily reads data - if data already in cache it just creates MDL
that describes pages within cache.

CcPrepareMdlWrite - now this I am not sure of… Does it read the
data into the MDLs first, and then returns the MDL, or does it just
assume that the caller will fill the entire range he asked for, and the
rest is zero (i.e. is the region zero initialized)?

The same thing - it doesn’t make a copy of the data - just return MDL that
describes data in cache so caller can copy its own data directly into the
cache or pass this MDL to device driver that performs IO.

Alexei.

3

> >For read, I assume, CcMdlRead reads the data, and returns and MDL to

>it - CcMdlReadComplete just releases the pages…

Not necessarily reads data - if data already in cache it just creates MDL
that describes pages within cache.

OK, but it either case, it’s virtually similar to memory mapping,
right? You cannot write the data - can you get an MDL for both reading AND
writing at the same time?
Can multiple callers get the same data pages at the same time this
way?

>CcPrepareMdlWrite - now this I am not sure of… Does it read the
>data into the MDLs first, and then returns the MDL, or does it just
>assume that the caller will fill the entire range he asked for, and the
>rest is zero (i.e. is the region zero initialized)?

The same thing - it doesn’t make a copy of the data - just return MDL that
describes data in cache so caller can copy its own data directly into the
cache or pass this MDL to device driver that performs IO.

Yes, but does it allow the caller to read the data - same question as
above, actually (can both MDL read and write happen at the same time?).
BTW, do you mean pass the MDL to the file system?
I see that MdlRead/Write is CACHED (so the caller can ask for any file
range, including non sector aligned data). And the caller is supposed to
return the MDL to the FS so it can call CcMdlWriteComplete/Abort.

–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.

Alfa File Monitor - File monitoring library for Win32 developers.

4

>OK, but it either case, it’s virtually similar to memory mapping,

right?

It is not exactly memory mapping, it is just description of physical pages
that is suitable for DMA.

You cannot write the data - can you get an MDL for both reading AND
writing at the same time?

No, you can’t get such MDL thourgh this interface.

Can multiple callers get the same data pages at the same time this
way?

I don’t know, although I would expect that some syncronization is
provieded by cache manager.

Yes, but does it allow the caller to read the data - same question as
above, actually (can both MDL read and write happen at the same time?).

No, caller is not supposed to read data that were prepeared to be written
because the memory described by MDL may be locked using IoWriteAccess.

BTW, do you mean pass the MDL to the file system?

No, I meant that the caller may use MDL to pass the data to another
driver, for example in order to send the data over network.

And the caller is supposed to return the MDL to the FS so it can call
CcMdlWriteComplete/Abort.

Yes, caller suppose to notify file system which in turn notifies cache
manager that he is done with processing of the data and thus he doesn’t
need the MDL any more. Cache manager may do some other post-processing in
addition to releasing the MDL. For example, if cache manager provides
synchronization for such MDL read/write requests it is the point where it
can release resource.

Alexei.