From: Roddy, Mark [Mark_Roddy@stratus.com]
Sent: Wednesday, December 13, 2000 9:43 AM
To: NT Developers Interest List
Subject: [ntdev] RE: Finding top level requester from a driver



> 
> Isn't there some sort of process id in the IRP though?
> He isn't asking to get to the process virtual memory as I
> understand the question...just wants to know which process it
> is.  

If he meant what he said, that he has a disk filter rather than a file
system filter, then there will generally be no connection between the thread
contexts that create and send the IRPs in question to the disk and the
thread contexts that created and sent the original IO requests to the File
System. To be more specific, in general filesystem IO is cached in virtual
memory. Background worker threads move data in and out of this buffer cache.
Those threads create their own IRPs and, as the original poster observed, an
attempt to determine the process context results in a discovery that these
IRPs and their associated threads are all part of the system process.

He is filtering at the wrong level if he needs to distinguish user thread
context.

Mark Roddy
markr@hollistech.com
www.hollistech.com
WindowsNT Windows 2000 Consulting Services

---
You are currently subscribed to ntdev as: GlennEverhart@FirstUSA.com
To unsubscribe send a blank email to leave-ntdev-247T@lists.osr.com