Download EaseFilter Filter Driver SDK Setup File Download EaseFilter Filter Driver SDK Zip File
The IRP_MJ_WRITE request is sent by the I/O Manager or by a file system driver. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as WriteFile or when a kernel-mode component has called ZwWriteFile.
The file system driver should extract and decode the file object to determine the parameters and minor function code.
For MDL write requests, the file system should check the minor function code to determine which operation is requested. The following are the valid minor function codes, which can be used only for cached file I/O:
For more information about how to handle this IRP, study the FASTFAT sample that is included in the Windows Driver Kit (WDK).
The filter driver should perform any needed processing and, depending on the nature of the filter, either complete or fail the IRP, or pass it down to the next-lower driver on the stack.
A file system or filter driver calls IoGetCurrentIrpStackLocation with the given IRP to get a pointer to its own stack location in the IRP, shown in the following list as IrpSp. (The IRP is shown as Irp.) The driver can use the information that is set in the following members of the IRP and the IRP stack location in processing a create request:
A pointer to the target device object.
A pointer to a system-supplied buffer to be used as an intermediate system buffer, if the DO_BUFFERED_IO flag is set in DeviceObject->Flags. Otherwise, this member is set to NULL.
A pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the requested operation. If the IRP_MJ_WRITE request fails, the file system's write dispatch routine returns an error NTSTATUS value, and the value of Irp->IoStatus.Information is undefined and should not be used.
The address of a memory descriptor list (MDL) that describes the pages to which the data is to be written.
A pointer to the file object that is associated with DeviceObject. If the FO_SYNCHRONOUS_IO flag is set in IrpSp->FileObject->Flags, the file object was opened for synchronous I/O.
The IrpSp->FileObject parameter contains a pointer to the RelatedFileObject field, which is also a FILE_OBJECT structure. The RelatedFileObject field of the FILE_OBJECT structure is not valid during the processing of IRP_MJ_WRITE and should not be used.
If the SL_FORCE_DIRECT_WRITE flag is set, kernel-mode drivers can write to volume areas that they normally cannot write to because of direct write blocking. Direct write blocking was implemented for security reasons in Windows Vista and later operating systems. This flag is checked both at the file system layer and storage stack layer. For more information about direct write blocking, see Blocking Direct Write Operations to Volumes and Disks. The SL_FORCE_DIRECT_WRITE flag is available in Windows Vista and later versions of Windows.
Specifies the operation being requested and contains one of the following:
A LARGE_INTEGER variable that specifies the starting byte offset within the file of the data to be written.
Under certain circumstances, this parameter might contain a special value. For example:
If the following condition is true, this indicates that the current end of file should be used instead of an explicit file offset value:
IrpSp->Parameters.Write.ByteOffset.LowPart == FILE_WRITE_TO_END_OF_FILE and IrpSp->Parameters.Write.ByteOffset.HighPart == -1
Key value associated with a byte-range lock on the target file.
Length in bytes of the data to be written. If the write operation is successful, the number of bytes written is returned in the Information member of the IO_STATUS_BLOCK structure pointed to by Irp->IoStatus.
File systems round write and read operations at end of file up to a multiple of the sector size of the underlying file storage device. When processing pre-read or pre-write operations, filters that allocate and swap buffers need to round the size of an allocated buffer up to a multiple of the sector size of the associated device. If they do not, the length of data transferred from the underlying file system will exceed the allocated length of the buffer.