deleting files on w2k professional and w2k server

NTFSD
1

Hi all -

I am trying to delete files in my FSD, and I noticed that professional gets
the MJ_SET_FILE_INFORMATION IRP when deleting a file, so it’s file object
can be marked as “delete pending”, then at cleanup I can delete the file.

It appears that server does not send this IRP. I saw a question from Scott
Palmer from Nov 2000 with exactly the same question, but no one answered
it. Is this a stupid question? What am I doing wrong here?

Thanks - Greg Pearce

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Sorry, I was not accurate enough in my previous message. It is the
IRP_MJ_SET_INFORMATION call that is the problem for DeleteFile.

I found a message thread here from xxxxx@dps.com that describes this
problem to a tee. His work-around was to disable DFS, but I do not have
that luxury.

Apparently DFS fails this IRP if the FSD is not created using
IoCreateDevice with a type of FILE_DEVICE_DFS_VOLUME (0x00000036).
So, just for FUN, I created it this way, but nothing worked properly. For
example, I couldn’t map a network drive to my FSD Virtual Device after
that.

I normally create the file device with FILE_DEVICE_DISK_FILE_SYSTEM
and I create the disk device with FILE_DEVICE_VIRTUAL_DISK.

There was never an answer to this question from November 2000 (Search OSR
List Serv for “DFS” and “DeleteFile”).

Pleeeze! Can someone help me here?! I’m going nuts!

I’m just trying to delete a file in a FSD (Not a filter driver) and it
works on Pro but not on Server! The IRP_MJ_SET_INFORMATION call never
makes it to my driver. I’d like to get DFS to leave me alone!

Thanks - Greg

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

There is no such thing as a SKU difference at that basic level of the
system.

Note that in order to send IO out of user mode, you have to have a
handle and that means you got a create at some point. That create may be
failing for some reason - watch all of the operations going by on a
delete request and see where the trails diverge. One way to do this in
the debugger is to get a system with N disks, N-1 of them of filesystem
A and 1 of filesystem B with nothing else on it. Use filesystem B
(NTFS/FAT/whatever) and issue the relavent operation. Set breakpoints at
the filesystem major entry points, in this case xxxCommonCreate and
xxxCommonSetInformation (insert Ntfs or Fat as appropriate). Use a byte
watchpoint on the IRP CurrentStackLocation field to sniff IRP completion
(or dispatch).

-----Original Message-----
From: xxxxx@filetek.com [mailto:xxxxx@filetek.com]
Sent: Wednesday, August 08, 2001 5:22 AM
To: File Systems Developers
Subject: [ntfsd] deleting files on w2k professional and w2k server

Hi all -

I am trying to delete files in my FSD, and I noticed that professional
gets
the MJ_SET_FILE_INFORMATION IRP when deleting a file, so it’s file
object
can be marked as “delete pending”, then at cleanup I can delete the
file.

It appears that server does not send this IRP. I saw a question from
Scott
Palmer from Nov 2000 with exactly the same question, but no one answered

it. Is this a stupid question? What am I doing wrong here?

Thanks - Greg Pearce

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Greg,

Have you confirmed that this is Dfs doing this? While I understand that you
cannot “normally” disable Dfs, if you can disable it long enough to confirm
that it is Dfs that is blocking the deletion operation, that would at least
confirm your suspicion.

If it is Dfs that is responsible, one potential solution would be to filter
Dfs and redirect the deletion operation around to your FSD. Since Dfs is
operating as a filter driver, it can implement essentially any semantics it
so desires - although, I must admit I do not understand how Dfs could work
for *anyone* if one is not allowed to delete files.

So, I suspect there’s something more subtle going on here, but it is
difficult to ascertain what it might be based upon the information you
provided thus far.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@filetek.com [mailto:xxxxx@filetek.com]
Sent: Tuesday, August 07, 2001 9:00 PM
To: File Systems Developers
Subject: [ntfsd] Re: deleting files on w2k professional and w2k server

Sorry, I was not accurate enough in my previous message. It is the
IRP_MJ_SET_INFORMATION call that is the problem for DeleteFile.

I found a message thread here from xxxxx@dps.com that describes this
problem to a tee. His work-around was to disable DFS, but I do not have
that luxury.

Apparently DFS fails this IRP if the FSD is not created using
IoCreateDevice with a type of FILE_DEVICE_DFS_VOLUME (0x00000036).
So, just for FUN, I created it this way, but nothing worked properly. For
example, I couldn’t map a network drive to my FSD Virtual Device after
that.

I normally create the file device with FILE_DEVICE_DISK_FILE_SYSTEM
and I create the disk device with FILE_DEVICE_VIRTUAL_DISK.

There was never an answer to this question from November 2000 (Search OSR
List Serv for “DFS” and “DeleteFile”).

Pleeeze! Can someone help me here?! I’m going nuts!

I’m just trying to delete a file in a FSD (Not a filter driver) and it
works on Pro but not on Server! The IRP_MJ_SET_INFORMATION call never
makes it to my driver. I’d like to get DFS to leave me alone!

Thanks - Greg

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Tony,

I tried to disable DFS by going into Services, set it to “disabled”, then
restarted the computer, and the same problem still occurs. So I guess DFS
is not the cause, (assuming there was not something else I should do to
disable it completely).

The reason I thought it was DFS was because Scott Palmer had a similar
problem and he responded to a private email to me that they got around it
by disabling DFS. His problem report in this newsgroup did describe my
symptoms exactly, however.

I am going through the running services on my server today to see if
disabling some of them might help the situation. I am just not sure which
ones I can turn off without hurting myself!

I wish that there was some way I could determine faithfully that a
particular IRP comes from DFS, and I would complete them or pass them on
without dealing with them.

Is there some more information that I could provide here to help us with
this problem? I do know that the first 51 IRPs processed for a delete are
the same on w2k pro and on w2k server. It’s at the 52rd IRP that things
become different. On w2k pro, IRP 52 is a IRP_MJ_SET_INFORMATION IRP (that
tells me that this is a request to delete the file), then IRP 53 is a
cleanup request IRP, followed by IRP 54 which is a file close request.

On w2k server, irp 52 is a cleanup request, followed by IRP 53 which is the
file close IRP. There is no IRP_MJ_SET_INFORMATION IRP in the entire
trace.

Thanks for your time, and please let me know if I can provide more
information…

Greg Pearce

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

Greg,

Perhaps you can use device tree (either a version from the OSR web site, or
from the Windows XP DDK) to examine the device stack.

One possible issue here is that you have a layering problem of some sort.
That is, there is a driver present on your server system that is not present
on your professional system - and the driver on server is “bypassing” your
filter driver.

I say this because, thinking about this it seems obvious that if you are
seeing everything EXCEPT the set information, that means the set information
isn’t arriving at whatever filter you are using to examine this. I’ve been
assuming you are using filemon - but in that case it would be layered on TOP
of Dfs, so the IRP would have to arrive in filemon. If it isn’t getting to
filemon, that means either (a) the IRP is being passed directly to something
below filemon; or (b) the IRP is never being sent at all.

The “trick” here is that you are going to have to trace through the delete
logic (coming down from NtSetInformationFile) to see where the IRP is
disappearing - obviously, file deletion WORKS on server, it just doesn’t
work in your configuration for some reason.

Alas, this is probably going to be lots of slow, painful debugger work, but
that will (eventually) lead you to the point where the IRP disappears.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@filetek.com [mailto:xxxxx@filetek.com]
Sent: Thursday, August 09, 2001 9:41 AM
To: File Systems Developers
Subject: [ntfsd] Re: deleting files on w2k professional and w2k server

Tony,

I tried to disable DFS by going into Services, set it to “disabled”, then
restarted the computer, and the same problem still occurs. So I guess DFS
is not the cause, (assuming there was not something else I should do to
disable it completely).

The reason I thought it was DFS was because Scott Palmer had a similar
problem and he responded to a private email to me that they got around it
by disabling DFS. His problem report in this newsgroup did describe my
symptoms exactly, however.

I am going through the running services on my server today to see if
disabling some of them might help the situation. I am just not sure which
ones I can turn off without hurting myself!

I wish that there was some way I could determine faithfully that a
particular IRP comes from DFS, and I would complete them or pass them on
without dealing with them.

Is there some more information that I could provide here to help us with
this problem? I do know that the first 51 IRPs processed for a delete are
the same on w2k pro and on w2k server. It’s at the 52rd IRP that things
become different. On w2k pro, IRP 52 is a IRP_MJ_SET_INFORMATION IRP (that
tells me that this is a request to delete the file), then IRP 53 is a
cleanup request IRP, followed by IRP 54 which is a file close request.

On w2k server, irp 52 is a cleanup request, followed by IRP 53 which is the
file close IRP. There is no IRP_MJ_SET_INFORMATION IRP in the entire
trace.

Thanks for your time, and please let me know if I can provide more
information…

Greg Pearce

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

Thanks for the response, Tony. I have received a response from Microsoft
on this problem, and I have inserted it below. If you can shed any
additional light on this for a workaround, etc., I’d appreciate it. This
is an interesting response, to say the least:

Here’s the response:

Greg, Hello!

I just looked through the Win2k code and, yes, it does fail the
IRP_MJ_SET_INFORMATION IRP, if the device type is not
FILE_DEVICE_DFS_VOLUME, with a status of STATUS_INVALID_DEVICE_REQUEST.
However, this has now been fixed with the XP code I looked at, in XP it
just passes the IRP through. There might be a fix for this on Win2K,
but
I’m not sure.

I am still looking around to see if I can see a better person to answer
this.

Thanks,
(Name deleted to protect the innocent)

Thanks - Greg

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com