what status code is acceptable after IRP_MJ_CREATE?

NTFSD
1

Hello

I want to log a file operation from the moment of IRP_MJ_CREATE till that
fileobject gets a IRP_MJ_CLEANUP.

What ‘status’ codes are acceptable and mean that the fileobject after the
IRP_MJ_CREATE will be used till IRP_MJ_CLEANUP?

I currently test if NT_SUCCESS(status) then start logging all operations to
the file object.

But should I test instead for “status == STATUS_SUCCESS”?

Because if “status==STATUS_REPARSE” then same IRP will not get its
IRP_MJ_CLEANUP.

Hope my question was clear.

Thanks,
Elias

2

This is the test that you should do:

If (NT_SUCCESS(status) && (status != STATUS_REPARSE)) {

Do logging
}

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of lallous
Sent: Wednesday, September 22, 2004 9:11 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] what status code is acceptable after IRP_MJ_CREATE?

Hello

I want to log a file operation from the moment of IRP_MJ_CREATE till
that
fileobject gets a IRP_MJ_CLEANUP.

What ‘status’ codes are acceptable and mean that the fileobject after
the
IRP_MJ_CREATE will be used till IRP_MJ_CLEANUP?

I currently test if NT_SUCCESS(status) then start logging all operations
to
the file object.

But should I test instead for “status == STATUS_SUCCESS”?

Because if “status==STATUS_REPARSE” then same IRP will not get its
IRP_MJ_CLEANUP.

Hope my question was clear.

Thanks,
Elias

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

> Because if “status==STATUS_REPARSE” then same IRP will not get its

IRP_MJ_CLEANUP.

This is because STATUS_REPARSE actually means
“Hey I want to open another file”.

I think the I/O manager will simply reuse the file object
and send it down with another create IRP
(to the same or to another device).

L.

4

The definition of STATUS_REPARSE as a success code was unfortunate
because functionally it is equivalent to the create failing. This is
something you will have to explicitly test for in create.

Note that the IO Manager does NOT reuse the same file object. It
actually frees it and allocates a new one. If it appears to be the same
it is luck in that it happened to reuse the same block of memory it just
freed.

We have received several requests to be able to determine if a new
create irp is related to a previous create irp where STATUS_REPARSE was
returned. There is nothing available in any of the released OS’s today
but the ability to determine this will be available in Longhorn.

Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ladislav Zezula
Sent: Wednesday, September 22, 2004 10:18 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] what status code is acceptable after IRP_MJ_CREATE?

Because if “status==STATUS_REPARSE” then same IRP will not get its
IRP_MJ_CLEANUP.

This is because STATUS_REPARSE actually means
“Hey I want to open another file”.

I think the I/O manager will simply reuse the file object
and send it down with another create IRP
(to the same or to another device).

L.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com