My filter is upper disk driver, I wanna capture the change on the device and record the change in the file.However, there are some WRITE IRP on the device before filesystem is active. Is the write IRP able to ingore before filesystem active?
If I can write to system partition before other filesystem active?
where is the frist entry point I can read/write file
This is dependant on a lot of things, is it a write to a file for the disk
you are filtering, or some other device? How do you know there is a file
system on the disk? You can create a file system filter to do this, you
can use IoRegisterBootDriverInitialization and then have a polling scheme if
nessecary (assuming this is on the boot drive). You can have a driver that
starts at system start that can then do the work, or at least notify you.
Bottom line there is no magic IRP to the disk layer that says the file
system layer is now ready.
If you are dependant on a file system above you, for anything other than the
boot drive, you can have lots of problems.
–
Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
wrote in message news:xxxxx@ntdev…
> where is the frist entry point I can read/write file
>
As a practical matter, what WE typically do is wait until we see the first write IRP come to our filter. When we see that write, we hold it, we do whatever writes we’ve been holding, and then we let the held write IRP proceed.
This works well, and avoid a number of annoying problems we’ve seen in this path.
So, it’s not an answer to your question exactly, but it’s a work-around that we’ve used numerous times with good effect.
Peter
OSR
Thanks Peter, That’s good for not boot drive . When face boot drive, it will be dead loop. For an example, when u wanna create file, it become a write IRP , and then hold it.
Best Regards.
June
System Software Development Dept
----- Original Message -----
From: xxxxx@osr.com
Date: Tuesday, January 20, 2009 10:59 pm
Subject: RE:[ntdev] what’s write IRP done before filesystem is active?
To: Windows System Software Devs Interest List
>
>
> As a practical matter, what WE typically do is wait until we see the
> first write IRP come to our filter. When we see that write, we hold
> it, we do whatever writes we’ve been holding, and then we let the held
> write IRP proceed.
>
> This works well, and avoid a number of annoying problems we’ve seen
> in this path.
>
> So, it’s not an answer to your question exactly, but it’s a
> work-around that we’ve used numerous times with good effect.
>
> Peter
> OSR
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
That’s right. It’s so many problem to opreate a file in the disk driver filter, such as re-entry problem. But I need caputure and record the chang in a file.
My orignal Idea is record all drive’s change in a file which locates on the boot drive or system partition.
Best Regards.
June
System Software Development Dept
----- Original Message -----
From: Don Burn
Date: Tuesday, January 20, 2009 10:54 pm
Subject: Re:[ntdev] what’s write IRP done before filesystem is active?
To: Windows System Software Devs Interest List
> This is dependant on a lot of things, is it a write to a file for the
> disk
> you are filtering, or some other device? How do you know there is a
> file
> system on the disk? You can create a file system filter to do this,
> you
> can use IoRegisterBootDriverInitialization and then have a polling
> scheme if
> nessecary (assuming this is on the boot drive). You can have a
> driver that
> starts at system start that can then do the work, or at least notify
> you.
> Bottom line there is no magic IRP to the disk layer that says the
> file
> system layer is now ready.
>
> If you are dependant on a file system above you, for anything other
> than the
> boot drive, you can have lots of problems.
>
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows Filesystem and Driver Consulting
> Website: http://www.windrvr.com
> Blog: http://msmvps.com/blogs/WinDrvr
>
>
>
> wrote in message news:xxxxx@ntdev…
> > where is the frist entry point I can read/write file
> >
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>
> As a practical matter, what WE typically do is wait until we see the first write IRP come to our filter. When we see that write, we hold it, we do whatever writes we’ve been holding, and then we let the held write IRP proceed.
This works well, and avoid a number of annoying problems we’ve seen in this path.
Yes, I have done the same thing in my virtual scsi miniport driver.
Before virtual block device is prepared to process R/W SCSI command, I
just return SRB_STATUS_BUSY or SRB_STATUS_ERROR to port driver. It works
fine in my project. But only one thing I am worried about is that if
virtual block device isn’t prepared for a long time, windows may BSOD
with 0x7B error code. But till now, I never see that happen since
virtual device can be initialized very fast.
Thanks
Wayne
Hmmmm… For the boot drive, one solution we’ve used is to do direct I/O (not through the file system) to some reserved space on the volume. That tends to avoid lots of problems.
Peter
OSR
Is there some good method to get reserved space on a volume or partiton which exist a filesystem?
My Method:
- First to create file on the volmue or partiton
- Record the file’s LCN
- Refuse all IRP on the file’s LCN (which means that the sector is likely a bad sector)
- My disk filter build IRP on the record LCN and record my insterting information.
Hmmmm… For the boot drive, one solution we’ve used is to do direct I/O (not
through the file system) to some reserved space on the volume. That tends to
avoid lots of problems.
Peter
OSR
Remember that the LCN can be multiple extents depending on the size
of your file. Rarely have I found a file of reasonable size to be
defined in a single LCN extent.
Taking the above in to consideration what you’re doing as a disk
filter should work. Personally, when I’ve done something like this
in the past as a volume filter I’ve also used FSCTL_MARK_HANDLE on
the file to stop de-fraggers and other things trying to move the file about.
As for 4) again be aware that your file may have multiple LCN
extents, this complicates the write process since you must calculate
which extent the write falls in to as well as coping with crossing
extent boundaries.
If you’re using the file system to initially create this file
(easiest option) then there’s no point going to a lot of work to try
to find a free contiguous space in the F/S of the size you
want. Because eventually you’ll have to cope with the situation
where there isn’t sufficient contiguous free space. So you might as
well cope with handling multiple LCN extents from the beginning - it
saves a lot of frustration later.
Mark.
At 09:47 22/01/2009, xxxxx@huaweisymantec.com wrote:
Is there some good method to get reserved space on a volume or
partiton which exist a filesystem?My Method:
- First to create file on the volmue or partiton
- Record the file’s LCN
- Refuse all IRP on the file’s LCN (which means that the sector is
likely a bad sector)- My disk filter build IRP on the record LCN and record my
insterting information.
Hmmmm… For the boot drive, one solution we’ve used is to do
direct I/O (not
through the file system) to some reserved space on the volume. That tends to
avoid lots of problems.Peter
OSR
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer