Explore Request Cycle Annoying...

NTFSD
1

I am facing a strange behaviour of file system calls by explorer. I have observed continuous request for cycle create->QueryInfo->QueryVolume->Close.Even When i copy some thing in my file system these request just slow down complete system(VM).And my system unable to process write operation due to slowed down system by these request.Does anyone having Idea. Why these request are coming continuously.

FileSpy Trace

1412 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 89AA3F20 IRP_MJ_CREATE 00000884 00000000 977AB048 B1076EC0 8BB86AB8 00000002 00000000 \Device\AFSFileSystem STATUS_SUCCESS FILE_OPEN CreOpts: 00000021 Access: 00100000 Share: 0 Attrib: 0 Result: FILE_OPENED
1413 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20 IRP_MJ_QUERY_INFORMATION 00060870 00000000 977AB048 B1076EC0 8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS FileNameInformation
1414 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20 IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 00000000 977AB048 B1076EC0 8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS FileFsVolumeInformation Length: 00000222
1415 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20 IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 00000000 977AB048 B1076EC0 8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS FileFsAttributeInformation Length: 0000021A
1416 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20 IRP_MJ_CLEANUP 00000404 00000000 977AB048 B1076EC0 8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
1417 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20 IRP_MJ_CLOSE 00000404 00000000 977AB048 B1076EC0 8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS

2

What operating system are you running on? Do you have AFS installed on
the test system?

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com http:</http:>
866.263.9295

------ Original Message ------
From: xxxxx@gmail.com
To: “Windows File Systems Devs Interest List”
Sent: 4/25/2015 2:42:30 PM
Subject: [ntfsd] Explore Request Cycle Annoying…

>I am facing a strange behaviour of file system calls by explorer. I
>have observed continuous request for cycle
>create->QueryInfo->QueryVolume->Close.Even When i copy some thing in my
>file system these request just slow down complete system(VM).And my
>system unable to process write operation due to slowed down system by
>these request.Does anyone having Idea. Why these request are coming
>continuously.
>
>
>FileSpy Trace
>=============================================
>1412 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 89AA3F20
>IRP_MJ_CREATE 00000884 00000000 977AB048 B1076EC0 8BB86AB8 00000002
>00000000 \Device\AFSFileSystem STATUS_SUCCESS FILE_OPEN CreOpts:
>00000021 Access: 00100000 Share: 0 Attrib: 0 Result: FILE_OPENED
>1413 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20
>IRP_MJ_QUERY_INFORMATION 00060870 00000000 977AB048 B1076EC0 8BB86AB8
>00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
>FileNameInformation
>1414 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20
>IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 00000000 977AB048 B1076EC0
>8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
>FileFsVolumeInformation Length: 00000222
>1415 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20
>IRP_MJ_QUERY_VOLUME_INFORMATION 00060870 00000000 977AB048 B1076EC0
>8BB86AB8 00040002 B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
>FileFsAttributeInformation Length: 0000021A
>1416 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20
>IRP_MJ_CLEANUP 00000404 00000000 977AB048 B1076EC0 8BB86AB8 00040002
>B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
>1417 13:24:59.967 0 Explorer.EXE 2784 89AE15F8 IRP 87B20F20
>IRP_MJ_CLOSE 00000404 00000000 977AB048 B1076EC0 8BB86AB8 00040002
>B1076F08 \Device\AFSFileSystem STATUS_SUCCESS
>
>
>—
>NTFSD is sponsored by OSR
>
>OSR is hiring!! Info at http://www.osr.com/careers
>
>For our schedule of debugging and file system seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

3

I am using Windows 8.1… AFS is my own file system … and that is installed on system…

4

So it asks for the file name. What are you returning here?

My sense is Explorer doesn’t like your answer, so it asks for information about the volume:

Damn! You’re returning 222 bytes? That’s HUGE.

typedef struct _FILE_FS_VOLUME_INFORMATION {
LARGE_INTEGER VolumeCreationTime;
ULONG VolumeSerialNumber;
ULONG VolumeLabelLength;
BOOLEAN SupportsObjects;
WCHAR VolumeLabel[1];
} FILE_FS_VOLUME_INFORMATION, *PFILE_FS_VOLUME_INFORMATION;

So if I read this right, you are returning a 204 byte long volume label (I count 18 bytes to VolumeLable[0]). That is big. Not illegal, just vastly bigger than you see from a typical call here.

There are only two reasons to make this call: to ask how big an individual component can be or to ask what the name of the file system is. Once again… wow, I’m really surprised at the size. And wait, it’s not even decimal, it’s HEX.

So it’s not 204 bytes for your volume name, it’s 528 bytes.

Similarly, your file system name is clocking in at 526 bytes (I count 12 bytes to FileSystmeName[0]):

typedef struct _FILE_FS_ATTRIBUTE_INFORMATION {
ULONG FileSystemAttributes;
LONG MaximumComponentNameLength;
ULONG FileSystemNameLength;
WCHAR FileSystemName[1];
} FILE_FS_ATTRIBUTE_INFORMATION, *PFILE_FS_ATTRIBUTE_INFORMATION;

“Never mind, I give up…”

Why are you indicating such large return buffers? Is the return buffer even BIG enough for that much data? I suppose it must be, otherwise you’d have failed it.

So my advice: look at what you’re returning from these calls. Explorer isn’t liking what you send back.

Tony
OSR