This is a side-effect of the fact that Notepad is using memory mapped files.
The VM system does not know the correct size of the file (the EOF) so it
sends an IRP_MJ_SET_INFORMATION, indicating the VM system is going to
perform a paging write on the first 4096 bytes (PAGE_SIZE on the IA32
system.)
The file system has logic within it that handles this case. In the IFS Kit,
you can see this in fastfat (fileinfo.c.) It is at line 4203 in the XP IFS
Kit (and there is comparable code in earlier versions):
//
// Do a special case here for the lazy write of file sizes.
//
if
(IoGetCurrentIrpStackLocation(Irp)->Parameters.SetFile.AdvanceOnly) {
//
// Only attempt this if the file hasn’t been “deleted on close”
and
// this is a good FCB.
//
if (!IsFileDeleted( IrpContext, Fcb ) && (Fcb->FcbCondition ==
FcbGood)) {
PDIRENT Dirent;
PBCB DirentBcb;
//
// Never have the dirent filesize larger than the fcb
filesize
//
if (NewFileSize >= Fcb->Header.FileSize.LowPart) {
NewFileSize = Fcb->Header.FileSize.LowPart;
}
The key here is the last fragment (I actually talk about this very fragment
of code in the file systems class I teach!) If the file is 56 bytes long
(for example) and the “new size” is 4096, the NewFileSize will be “4096”, it
will compare it against the actual file size (“56”) and set the NewFileSize
to “56” and this will then be used.
What is amazing to me about this particular code sequence is that the file
systems do a LOT of work here and the end result is that very little REALLY
happens - the file is marked as modified, a directory change notification
may be indicated (because the file size changed) but any of the code that
does “real” work here is skipped because the file has not really changed
size.
We’ve found exactly this behavior in our own file systems, and we have
special case code that ignores these operations as well.
So, what this means is that you are seeing the expected behavior.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com
See the new NTFSD FAQ on the OSR Web Site!
-----Original Message-----
From: xxxxx@math.uic.edu [mailto:xxxxx@math.uic.edu]
Sent: Sunday, September 30, 2001 10:00 PM
To: File Systems Developers
Subject: [ntfsd] FileEndOfFileInformation gives me confusing parameter.
I am writing a filter driver, I noticed in NT2K, if I use notepad to edit a
file such as c:\test3. I get a lot of create/close, sometimes there are
more create than close. Finally, I will see that system.exe issues
IRP_MJ_WRITE and IRP_MJ_SET_INFORMATION. Both has IRP_PAGING_IO and
IRP_SYNCHRONOUS_PAGING_IO. My problem here is in the IRP_MJ_SET_INFORMATION
is always set 4096 bytes even my real file is actually very small.
Secondly, why sometimes there will be create than close. Can anybody shed
some light on this?
Thanks.
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com