Why system send IRP_MJ_WRITE twice

NTFSD
1

I am writing a filter file driver to encrypt data, but now it only encrypt
the file c:\1234.txt. When I write data to the file, the write routine
implement twice sometimes. I don’t want to encrypt the data twice. why? what
should I do?

2

Its a guess, but I’d think most probably you are seeing the usual thing
here, where the system first tries a FastIo write, and when that fails
(because the bit of the file isnt in cache) the system uses a IRP write.
Is that right?

3

Perhaps, the first one is a usual cached IO while the other one is paged
one? Check the flags. You must encrypt data only for non-cached IO.

-htfv

----- Original Message -----
From: “tu21cn”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Friday, August 08, 2003 1:11 PM
Subject: [ntfsd] Why system send IRP_MJ_WRITE twice

> I am writing a filter file driver to encrypt data, but now it only encrypt
> the file c:\1234.txt. When I write data to the file, the write routine
> implement twice sometimes. I don’t want to encrypt the data twice. why?
what
> should I do?
>
>
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

4

Thanks for your help! I check the Irp->Flags, but it is 43(IRP_NOCACHE |
IRP_PAGING_IO|IRP_INPUT_OPERATION) both.

“Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
>
> Perhaps, the first one is a usual cached IO while the other one is paged
> one? Check the flags. You must encrypt data only for non-cached IO.
>
> -htfv
>
>
> ----- Original Message -----
> From: “tu21cn”
> Newsgroups: ntfsd
> To: “File Systems Developers”
> Sent: Friday, August 08, 2003 1:11 PM
> Subject: [ntfsd] Why system send IRP_MJ_WRITE twice
>
>
> > I am writing a filter file driver to encrypt data, but now it only
encrypt
> > the file c:\1234.txt. When I write data to the file, the write routine
> > implement twice sometimes. I don’t want to encrypt the data twice. why?
> what
> > should I do?
> >
> >
> >
> >
> >
> >
> > —
> > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
>
>

5

You can check the stack trace when you get IRP_MJ_WRITE request to see where
it comes from. Perhaps you have some reentrancy issues or something. There
are dozens of reasons depending on how you write to your file.

-htfv

----- Original Message -----
From: “tu21cn”
Newsgroups: ntfsd
To: “File Systems Developers”
Sent: Monday, August 11, 2003 4:35 AM
Subject: [ntfsd] Re: Why system send IRP_MJ_WRITE twice

> Thanks for your help! I check the Irp->Flags, but it is 43(IRP_NOCACHE |
> IRP_PAGING_IO|IRP_INPUT_OPERATION) both.
>
> “Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
> >
> > Perhaps, the first one is a usual cached IO while the other one is paged
> > one? Check the flags. You must encrypt data only for non-cached IO.
> >
> > -htfv
> >
> >
> > ----- Original Message -----
> > From: “tu21cn”
> > Newsgroups: ntfsd
> > To: “File Systems Developers”
> > Sent: Friday, August 08, 2003 1:11 PM
> > Subject: [ntfsd] Why system send IRP_MJ_WRITE twice
> >
> >
> > > I am writing a filter file driver to encrypt data, but now it only
> encrypt
> > > the file c:\1234.txt. When I write data to the file, the write routine
> > > implement twice sometimes. I don’t want to encrypt the data twice.
why?
> > what
> > > should I do?
> > >
> > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> >
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

6

Do you encrypt data directly in the buffer being written or you encrypt data
in a separate buffer and replace buffer in the IRP?
Encrypting data “in place” will lead to data in cache become encrypted. Then
next paging write will contain encrypted data.
You should never change data directly in the user buffer during write
operation.

Alexei.

“tu21cn” wrote in message news:xxxxx@ntfsd…
>
> Thanks for your help! I check the Irp->Flags, but it is 43(IRP_NOCACHE |
> IRP_PAGING_IO|IRP_INPUT_OPERATION) both.
>
> “Alexey Logachyov” wrote in message news:xxxxx@ntfsd…
> >
> > Perhaps, the first one is a usual cached IO while the other one is paged
> > one? Check the flags. You must encrypt data only for non-cached IO.
> >
> > -htfv
> >
> >
> > ----- Original Message -----
> > From: “tu21cn”
> > Newsgroups: ntfsd
> > To: “File Systems Developers”
> > Sent: Friday, August 08, 2003 1:11 PM
> > Subject: [ntfsd] Why system send IRP_MJ_WRITE twice
> >
> >
> > > I am writing a filter file driver to encrypt data, but now it only
> encrypt
> > > the file c:\1234.txt. When I write data to the file, the write routine
> > > implement twice sometimes. I don’t want to encrypt the data twice.
why?
> > what
> > > should I do?
> > >
> > >
> > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> >
>
>
>
>

7

Thanks for your help! Yes, I encrypted data directly in the user buffer. I
will try to allocate another buffer to write.

“Alexei Jelvis” wrote in message news:xxxxx@ntfsd…
>
> Do you encrypt data directly in the buffer being written or you encrypt
data
> in a separate buffer and replace buffer in the IRP?
> Encrypting data “in place” will lead to data in cache become encrypted.
Then
> next paging write will contain encrypted data.
> You should never change data directly in the user buffer during write
> operation.
>
> Alexei.
>
> “tu21cn” wrote in message news:xxxxx@ntfsd…
> >
> > Thanks for your help! I check the Irp->Flags, but it is 43(IRP_NOCACHE |
> > IRP_PAGING_IO|IRP_INPUT_OPERATION) both.
> >
> > “Alexey Logachyov” wrote in message
news:xxxxx@ntfsd…
> > >
> > > Perhaps, the first one is a usual cached IO while the other one is
paged
> > > one? Check the flags. You must encrypt data only for non-cached IO.
> > >
> > > -htfv
> > >
> > >
> > > ----- Original Message -----
> > > From: “tu21cn”
> > > Newsgroups: ntfsd
> > > To: “File Systems Developers”
> > > Sent: Friday, August 08, 2003 1:11 PM
> > > Subject: [ntfsd] Why system send IRP_MJ_WRITE twice
> > >
> > >
> > > > I am writing a filter file driver to encrypt data, but now it only
> > encrypt
> > > > the file c:\1234.txt. When I write data to the file, the write
routine
> > > > implement twice sometimes. I don’t want to encrypt the data twice.
> why?
> > > what
> > > > should I do?
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntfsd as: xxxxx@vba.com.by
> > > > To unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > >
> > >
> > >
> > >
> > >
> >
> >
> >
> >
>
>
>
>

8

> Thanks for your help! Yes, I encrypted data directly in the user buffer. I

This will grossly confuse most apps. The apps rely on the fact that the data
passed to write() is not changed.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com