Hi,
I want to know two things:
1.When I select a file in Windows Explorer by single-click the file icon, I can see its size. The FCB of the file must have been read out from the disk. But what kinds of IRPs are sent during this process?
2.When a file is opened, all the data in the file are read in to the cache of the system( At least I guess so). Then the data is transfered in to the memeory of the application. Am I right?
The second thing I want to know is the “What kinds of IRPs will be sent during the process of reading file from disk to memory?”
Thanks in advance!
-
If it looks only for file size it maybe send only
IRP_MJ_QUERY_INFORMATION but also it may send IRP_MJ_READ to read some
addition data for file format recognition. I do not think that FCB is read
out from the disk because it is internal file system structure in which a
file system maintains state for an open file.
-
Not all the data cached in any cases and not all files are cached. If
application uses memory mapped files - it isn’t true, app gets the pointer
where file data is. It will be IRP_MJ_READ with IRP_PAGING_IO flag set in
Irp->Flags if you mean reading data from disk during cache operation, but it
may be any other IRP_MJ_READ request if you mean reading data using
NtReadFile or others.
Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]
|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-262215-
|xxxxx@lists.osr.com] On Behalf Of headium2006@163.com
|Sent: Wednesday, September 13, 2006 10:59 AM
|To: Windows File Systems Devs Interest List
|Subject: [ntfsd] What kind of IRPs are sent?
|
|Hi,
|
|I want to know two things:
|
|1.When I select a file in Windows Explorer by single-click the file icon, I
|can see its size. The FCB of the file must have been read out from the
|disk. But what kinds of IRPs are sent during this process?
|
|2.When a file is opened, all the data in the file are read in to the cache
|of the system( At least I guess so). Then the data is transfered in to the
|memeory of the application. Am I right?
|The second thing I want to know is the “What kinds of IRPs will be sent
|during the process of reading file from disk to memory?”
|
|Thanks in advance!
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com
Do you ask about an FSD or a volume driver?
If about the volume driver, then the answer to all you questions is
IRP_MJ_READ.
The following answers are about the FSD.
But what kinds of IRPs are sent during this process?
What process? If “Reading FCB”, then there is no such operation( this is
not classical UNIX’s inode ). If you mean the operation which returns the
file size- this is IRP_MJ_QUERY_INFORMATION or one of the Fastio
operations - QueryNetworkInformation, QueryStandardInfo or QueryBasicInfo.
When a file is opened, all the data in the file are read in to the cache of
the system( At least I guess so).
Usually when a file is opened its private cache map is not initialized. The
cache is initialized during first read/write.
The second thing I want to know is the “What kinds of IRPs will be sent
during the process of reading file from disk to memory?”
What memory? If application’s buffer, then IRP_MJ_READ or FastIoRead. If the
memory mapping the file, then IRP_MJ_READ with IRP_PAGING_IO flag.
–
Slava Imameyev, xxxxx@hotmail.com
wrote in message news:xxxxx@ntfsd…
> Hi,
>
> I want to know two things:
>
> 1.When I select a file in Windows Explorer by single-click the file icon,
> I can see its size. The FCB of the file must have been read out from the
> disk. But what kinds of IRPs are sent during this process?
>
> 2.When a file is opened, all the data in the file are read in to the cache
> of the system( At least I guess so). Then the data is transfered in to the
> memeory of the application. Am I right?
> The second thing I want to know is the “What kinds of IRPs will be sent
> during the process of reading file from disk to memory?”
>
> Thanks in advance!
>
>Not all the data cached in any cases and not all files are cached. If
application uses memory mapped files - it isn’t true, app gets the pointer
where file data is.
Actually, the memory mapping the file and the cache’s memory are backed by
the same data segment and share the same pages, else the data consistency
will be lost.
–
Slava Imameyev, xxxxx@hotmail.com
“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
> 1. If it looks only for file size it maybe send only
> IRP_MJ_QUERY_INFORMATION but also it may send IRP_MJ_READ to read some
> addition data for file format recognition. I do not think that FCB is read
> out from the disk because it is internal file system structure in which a
> file system maintains state for an open file.
>
> 2. Not all the data cached in any cases and not all files are cached. If
> application uses memory mapped files - it isn’t true, app gets the pointer
> where file data is. It will be IRP_MJ_READ with IRP_PAGING_IO flag set in
> Irp->Flags if you mean reading data from disk during cache operation, but
> it
> may be any other IRP_MJ_READ request if you mean reading data using
> NtReadFile or others.
>
> Andrey Gunko
> soft Xpansion GmbH & Co.KG
> Programmer
> Powered by eKnow-how
> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
> 2984172 Internet: [www.maus-soft.com]
>
> |-----Original Message-----
> |From: xxxxx@lists.osr.com [mailto:bounce-262215-
> |xxxxx@lists.osr.com] On Behalf Of headium2006@163.com
> |Sent: Wednesday, September 13, 2006 10:59 AM
> |To: Windows File Systems Devs Interest List
> |Subject: [ntfsd] What kind of IRPs are sent?
> |
> |Hi,
> |
> |I want to know two things:
> |
> |1.When I select a file in Windows Explorer by single-click the file icon,
> I
> |can see its size. The FCB of the file must have been read out from the
> |disk. But what kinds of IRPs are sent during this process?
> |
> |2.When a file is opened, all the data in the file are read in to the
> cache
> |of the system( At least I guess so). Then the data is transfered in to
> the
> |memeory of the application. Am I right?
> |The second thing I want to know is the “What kinds of IRPs will be sent
> |during the process of reading file from disk to memory?”
> |
> |Thanks in advance!
> |
> |—
> |Questions? First check the IFS FAQ at
> |https://www.osronline.com/article.cfm?id=17
> |
> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
> |To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
You can download Filemon from www.sysintenals.com site or similar tools
from osronline that show IRPs and file path as you work on file
(single-click, open, save, delete, rename)
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
headium2006@163.com
Sent: Wednesday, September 13, 2006 1:29 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] What kind of IRPs are sent?
Hi,
I want to know two things:
1.When I select a file in Windows Explorer by single-click the file
icon, I can see its size. The FCB of the file must have been read out
from the disk. But what kinds of IRPs are sent during this process?
2.When a file is opened, all the data in the file are read in to the
cache of the system( At least I guess so). Then the data is transfered
in to the memeory of the application. Am I right?
The second thing I want to know is the “What kinds of IRPs will be sent
during the process of reading file from disk to memory?”
Thanks in advance!
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@phoenix.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
“If application uses memory mapped files - it isn’t true, app gets the
pointer where file data is” is the answer for this question: “Then the data
is transferred in to the memory of the application. Am I right?”
I know about cache coherency.
Andrey Gunko
soft Xpansion GmbH & Co.KG
Programmer
Powered by eKnow-how
Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
2984172 Internet: [www.maus-soft.com]
|-----Original Message-----
|From: xxxxx@lists.osr.com [mailto:bounce-262225-
|xxxxx@lists.osr.com] On Behalf Of Slava Imameyev
|Sent: Wednesday, September 13, 2006 12:28 PM
|To: Windows File Systems Devs Interest List
|Subject: Re:[ntfsd] What kind of IRPs are sent?
|
|>Not all the data cached in any cases and not all files are cached. If
|> application uses memory mapped files - it isn’t true, app gets the
|pointer
|> where file data is.
|
|Actually, the memory mapping the file and the cache’s memory are backed by
|the same data segment and share the same pages, else the data consistency
|will be lost.
|
|–
|Slava Imameyev, xxxxx@hotmail.com
|
|
|“Gunko Andrey” wrote in message news:xxxxx@ntfsd…
|> 1. If it looks only for file size it maybe send only
|> IRP_MJ_QUERY_INFORMATION but also it may send IRP_MJ_READ to read some
|> addition data for file format recognition. I do not think that FCB is
|read
|> out from the disk because it is internal file system structure in which a
|> file system maintains state for an open file.
|>
|> 2. Not all the data cached in any cases and not all files are cached. If
|> application uses memory mapped files - it isn’t true, app gets the
|pointer
|> where file data is. It will be IRP_MJ_READ with IRP_PAGING_IO flag set in
|> Irp->Flags if you mean reading data from disk during cache operation, but
|> it
|> may be any other IRP_MJ_READ request if you mean reading data using
|> NtReadFile or others.
|>
|> Andrey Gunko
|> soft Xpansion GmbH & Co.KG
|> Programmer
|> Powered by eKnow-how
|> Konigsallee 45 D-44789 Bochum Tel: +49 234 2984171 Fax: +49 234
|> 2984172 Internet: [www.maus-soft.com]
|>
|> |-----Original Message-----
|> |From: xxxxx@lists.osr.com [mailto:bounce-262215-
|> |xxxxx@lists.osr.com] On Behalf Of headium2006@163.com
|> |Sent: Wednesday, September 13, 2006 10:59 AM
|> |To: Windows File Systems Devs Interest List
|> |Subject: [ntfsd] What kind of IRPs are sent?
|> |
|> |Hi,
|> |
|> |I want to know two things:
|> |
|> |1.When I select a file in Windows Explorer by single-click the file
|icon,
|> I
|> |can see its size. The FCB of the file must have been read out from the
|> |disk. But what kinds of IRPs are sent during this process?
|> |
|> |2.When a file is opened, all the data in the file are read in to the
|> cache
|> |of the system( At least I guess so). Then the data is transfered in to
|> the
|> |memeory of the application. Am I right?
|> |The second thing I want to know is the “What kinds of IRPs will be sent
|> |during the process of reading file from disk to memory?”
|> |
|> |Thanks in advance!
|> |
|> |—
|> |Questions? First check the IFS FAQ at
|> |https://www.osronline.com/article.cfm?id=17
|> |
|> |You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|> |To unsubscribe send a blank email to xxxxx@lists.osr.com
|>
|>
|
|
|
|—
|Questions? First check the IFS FAQ at
|https://www.osronline.com/article.cfm?id=17
|
|You are currently subscribed to ntfsd as: xxxxx@maus.donetsk.ua
|To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks for all the replies! I’ll try them one by one.
I have tried out the idea. It seems to work. At least, I can log the read and write operations on files by monitoring IRP_MJ_QUERY_INFORMATION. Thanks!
I’d like to try more creative ideas to log more operations on files apart from read and write! Hope to be informed of creative ideas!
> 1.When I select a file in Windows Explorer by single-click the file icon, I
can see
its size. The FCB of the file must have been read out from the disk. But what
kinds of IRPs are sent during this process?
IRP_MJ_QUERY_INFORMATION
2.When a file is opened, all the data in the file are read in to the cache of
the
system( At least I guess so). Then the data is transfered in to the memeory of
the
application. Am I right?
For cached files - yes.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com