WriteFile ReadFile Explanation

NTDEV
1

Hi,

MSDN explanation for the WriteFile/ReadFile is not sufficient.

So I want to know is there any documentation available for WriteFile/ReadFile complete flow…???

How IoManager manages the WriteFile/ReadFile Input Buffer of the application for the driver and back to the application in the response path…???

Is there any difference between the WriteFile and ReadFile driver stack…?? Does IoManager behaves differently in these cases…??

What are the drivers involved in this case and what’s the driver stack here…??

Thanks,
Sudhanshu

2

On Mar 17, 2018, at 11:03 PM, xxxxx@gmail.com wrote:
>
> MSDN explanation for the WriteFile/ReadFile is not sufficient.
> So I want to know is there any documentation available for WriteFile/ReadFile complete flow…???
> How IoManager manages the WriteFile/ReadFile Input Buffer of the application for the driver and back to the application in the response path…???
> Is there any difference between the WriteFile and ReadFile driver stack…?? Does IoManager behaves differently in these cases…??
> What are the drivers involved in this case and what’s the driver stack here…??

There isn’t too much to know from the application side. The behavior depends on whether the driver has set the DO_DIRECT_IO flag when the driver is initialized.

If DO_DIRECT_IO is not set, then both ReadFile and WriteFile will use buffered I/O, which means the I/O manager will copy the buffer into kernel space (for IRP_MJ_READ) or out of kernel space (for IRP_MJ_WRITE).

If DO_DIRECT_IO is set, then both ReadFile and WriteFile will use direct I/O, which means the I/O manager will lock the pages in memory and map them into kernel space in the IRP.
—
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

I am using File_FLAG_NO_BUFFEREING (Assuming it is DO_DIRECT_IO call).
So IOManager supposed to pass same buffer to the kernel.

I have written a sample driver in kernel to receive this request and
modify the same buffer.

This is what happened.

Send a buffer using WriteFile-> Modify the buffer in Kernel ->
Complete the requst ====> Buffer value didn’t get modify in
Application.
Send a buffer using ReadFile -> Modify the buffer in Kernel ->
Complete the request ====> Buffer value got modified in application.

This resulted in some understanding gap. Am I missing something here???

4

The buffer to write file is an input buffer. Think about it. The intent is to write the buffer somewhere, it isn’t to change the buffer. From the buffer perspective it is read, not written. The buffer to read file is an output buffer, the driver is expected to write to it.

File_FLAG_NO_BUFFEREING effects caching and file systems, I don’t think your driver is in the storage or FS stack from your description.

Bent from my phone

From: xxxxx@lists.osr.com on behalf of xxxxx@gmail.com
Sent: Sunday, March 18, 2018 2:06:03 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WriteFile ReadFile Explanation

I am using File_FLAG_NO_BUFFEREING (Assuming it is DO_DIRECT_IO call).
So IOManager supposed to pass same buffer to the kernel.

I have written a sample driver in kernel to receive this request and
modify the same buffer.

This is what happened.

Send a buffer using WriteFile-> Modify the buffer in Kernel ->
Complete the requst ====> Buffer value didn’t get modify in
Application.
Send a buffer using ReadFile -> Modify the buffer in Kernel ->
Complete the request ====> Buffer value got modified in application.

This resulted in some understanding gap. Am I missing something here???

—
NTDEV is sponsored by OSR

Visit the list online at: https:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at https:

To unsubscribe, visit the List Server section of OSR Online at https:</https:></https:></https:>

5

I completely understand the buffer to WriteFile is an input buffer. But the experiment I did just for checking the DO_DIRECT_IO behaviour in ReadFile and WriteFile.
How do I set Direct Io or Buffered Io when I call CreateFile.

I don’t see any flag which can specify Direct Io…??

6

You specify direct io/buffered behavior of read and write on the device object itself. The caller has no control. IOCTLs can specify the buffer behavior PMA per ioctl value basis

Bent from my phone

From: xxxxx@lists.osr.com on behalf of xxxxx@gmail.com
Sent: Sunday, March 18, 2018 8:51:39 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] WriteFile ReadFile Explanation

I completely understand the buffer to WriteFile is an input buffer. But the experiment I did just for checking the DO_DIRECT_IO behaviour in ReadFile and WriteFile.
How do I set Direct Io or Buffered Io when I call CreateFile.

I don’t see any flag which can specify Direct Io…??

—
NTDEV is sponsored by OSR

Visit the list online at: https:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at https:

To unsubscribe, visit the List Server section of OSR Online at https:</https:></https:></https:>

7

Thanks Doron for enlightening me in detail… I’ll check as you suggested…

Thanks