A question about the IRP flag for IRP_SET_INFORMATION

NTFSD
1

Hi,

I am working on a encryption filter driver. And have some questions about the IRP flags for IRP_SET_INFORMATION.

For Read/Write, the filter driver only handles the IRP whose Flags contains IRP_NOCACHE, IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO. The goal is to only modify the data on disk.

I just want to know what’s the meaning of these 3 flags for IRP_MJ_SET_INFORMATION (especially for set EOF)?
The MSDN page about IRP_MJ_SET_INFORMATION doesn’t say much about these flags.

I have done following test:

  1. Set file size in user mode
    Result: I saw IRP_MJ_SET_INFORMATION irp, and the IRPFlags doesn’t contain any of those 3 flags.

  2. Create new file, and keep writing data to a file
    Result: I saw two kinds of IRP_MJ_SET_INFORMATION (FileEndOfFileInformation):
    First - IRPFlags doesn’t contain any of those 3 flags.
    Second - Paging flag is set (But IRP_NOCACHE is not set)
    And it seems the paging I/O doesn’t really change the file size – before this paging I/O, the file size has already been changed.

Here are my questions:

  1. Is IRP_NOCACHE meaningful for set EOF?
  2. For read/write, filter driver only handles NonCached/Paging IRP. But obviously it cannot do that for set EOF – because the file size could be changed by the IRP without NonCached/Paging flag. Is it correct?

Thanks!

== Gavin

2

The flags are operation specific, some operations have no flags defined,
some have flags defined with the same value as another flag, so for
instance the IRP_PAGING_IO shares the same bit at IRP_MOUNT_COMPLETION.
Why do you think an IRP_MJ_SET_INFORMATION call would have a flag such
as IRP_PAGING_IO or IRP_NOCACHE which are there for actual I/O
operations?

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com” wrote in message
news:xxxxx@ntfsd:

> Hi,
>
> I am working on a encryption filter driver. And have some questions about the IRP flags for IRP_SET_INFORMATION.
>
> For Read/Write, the filter driver only handles the IRP whose Flags contains IRP_NOCACHE, IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO. The goal is to only modify the data on disk.
>
> I just want to know what’s the meaning of these 3 flags for IRP_MJ_SET_INFORMATION (especially for set EOF)?
> The MSDN page about IRP_MJ_SET_INFORMATION doesn’t say much about these flags.
>
> I have done following test:
> 1. Set file size in user mode
> Result: I saw IRP_MJ_SET_INFORMATION irp, and the IRPFlags doesn’t contain any of those 3 flags.
>
> 2. Create new file, and keep writing data to a file
> Result: I saw two kinds of IRP_MJ_SET_INFORMATION (FileEndOfFileInformation):
> First - IRPFlags doesn’t contain any of those 3 flags.
> Second - Paging flag is set (But IRP_NOCACHE is not set)
> And it seems the paging I/O doesn’t really change the file size – before this paging I/O, the file size has already been changed.
>
>
> Here are my questions:
> 1. Is IRP_NOCACHE meaningful for set EOF?
> 2. For read/write, filter driver only handles NonCached/Paging IRP. But obviously it cannot do that for set EOF – because the file size could be changed by the IRP without NonCached/Paging flag. Is it correct?
>
> Thanks!
>
> == Gavin

3

>2. Create new file, and keep writing data to a file

Result: I saw two kinds of IRP_MJ_SET_INFORMATION
(FileEndOfFileInformation):
First - IRPFlags doesn’t contain any of those 3 flags.
Second - Paging flag is set (But IRP_NOCACHE is not set)
And it seems the paging I/O doesn’t really change the file
size – before this paging I/O, the file size has already been >changed.

If IRP_PAGING_IO is set in the flags, this set information is coming from
the Cache Manager. I presume that AdvanceOnly is also set to TRUE in the I/O
stack location?

See here for an excellent explanation of what this set information call
means:

http://www.osronline.com/showthread.cfm?link=167251

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

4

In this case I suspect it really is IRP_PAGING_IO that is set in the IRP
flags. See my previous response.

-scott

–
Scott Noone
Consulting Associate and Chief System Problem Analyst
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Don Burn” wrote in message news:xxxxx@ntfsd…

The flags are operation specific, some operations have no flags defined,
some have flags defined with the same value as another flag, so for
instance the IRP_PAGING_IO shares the same bit at IRP_MOUNT_COMPLETION.
Why do you think an IRP_MJ_SET_INFORMATION call would have a flag such
as IRP_PAGING_IO or IRP_NOCACHE which are there for actual I/O
operations?

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@gmail.com” wrote in message
news:xxxxx@ntfsd:

> Hi,
>
> I am working on a encryption filter driver. And have some questions about
> the IRP flags for IRP_SET_INFORMATION.
>
> For Read/Write, the filter driver only handles the IRP whose Flags
> contains IRP_NOCACHE, IRP_PAGING_IO or IRP_SYNCHRONOUS_PAGING_IO. The goal
> is to only modify the data on disk.
>
> I just want to know what’s the meaning of these 3 flags for
> IRP_MJ_SET_INFORMATION (especially for set EOF)?
> The MSDN page about IRP_MJ_SET_INFORMATION doesn’t say much about these
> flags.
>
> I have done following test:
> 1. Set file size in user mode
> Result: I saw IRP_MJ_SET_INFORMATION irp, and the IRPFlags doesn’t
> contain any of those 3 flags.
>
> 2. Create new file, and keep writing data to a file
> Result: I saw two kinds of IRP_MJ_SET_INFORMATION
> (FileEndOfFileInformation):
> First - IRPFlags doesn’t contain any of those 3 flags.
> Second - Paging flag is set (But IRP_NOCACHE is not set)
> And it seems the paging I/O doesn’t really change the file
> size – before this paging I/O, the file size has already been changed.
>
>
> Here are my questions:
> 1. Is IRP_NOCACHE meaningful for set EOF?
> 2. For read/write, filter driver only handles NonCached/Paging IRP. But
> obviously it cannot do that for set EOF – because the file size could be
> changed by the IRP without NonCached/Paging flag. Is it correct?
>
> Thanks!
>
> == Gavin

5

@Don

Thanks for your reply.
Actually I don’t know if there is non-cache/paging for IRP_MJ_SET_INFORMATION. What I try to find out is if these flags are meaningful for Set EOF. Base on my observation, if I can see IRP_PAGING_IO flag, some times the input file size parameter is same as the real file size on disk.
So I try to understand the internal steps of setting file size.

6

Hi Scott,

I read that post, it’s very useful. I didn’t pay attention to AdvanceOnly in previous work.
I will try it now.

Thanks a lot!