Where is addr of data in IRP_NOCACHE write?

NTFSD
1

Where can I find out which address pointer to use in a write IRP in a file
system filter?

I was running my file system filter without processing any IRPs that had
IRP_NOCACHE set and the data was always available in Irp->MdlAddress. I
thought this was just the assumed location for fsd writes since neither
DO_BUFFERED_IO nor DO_DIRECT_IO was set in the device object.

When I turned on IRP_NOCACHE processing, I found IRPs with zero in
Irp->MdlAddress. By poking around I found out that Irp->UserBuffer seemed
to have the correct data. I’m not done researching the results yet but this
doesn’t seem consistent and I can’t find any docs that refer to
Irp->UserBuffer.

I’m very confused and the docs say nothing except to use DO_BUFFERED_IO and
DO_DIRECT_IO which don’t work.

2

This is “neither I/O” and user requests are sent to you via the user’s
address directly (Irp->UserBuffer). The paging system only HAS an MDL
so it sends the MDL to you (with an arbitrary - and possibly invalid -
address).

My general advise is: use Irp->MdlAddress if non-NULL, use
Irp->UserBuffer otherwise (this would be for the NEITHER case. For the
odd file system using buffered, you’d need to use
Irp->AssociatedIrp.SystemBuffer.)

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Hahn
Sent: Sunday, March 13, 2005 5:51 AM
To: ntfsd redirect
Subject: [ntfsd] Where is addr of data in IRP_NOCACHE write?

Where can I find out which address pointer to use in a write IRP in a
file
system filter?

I was running my file system filter without processing any IRPs that had

IRP_NOCACHE set and the data was always available in Irp->MdlAddress. I

thought this was just the assumed location for fsd writes since neither
DO_BUFFERED_IO nor DO_DIRECT_IO was set in the device object.

When I turned on IRP_NOCACHE processing, I found IRPs with zero in
Irp->MdlAddress. By poking around I found out that Irp->UserBuffer
seemed
to have the correct data. I’m not done researching the results yet but
this
doesn’t seem consistent and I can’t find any docs that refer to
Irp->UserBuffer.

I’m very confused and the docs say nothing except to use DO_BUFFERED_IO
and
DO_DIRECT_IO which don’t work.

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com