Thank you all for your help! I appreciate it a lot.
When I get the FileAllInformation query with QueryFile.Length set to sizeof(FILE_ALL_INFORMATION), I fill in all the values in that structure, except for NameInformation.FileName. I set IO_STATUS_BLOCK.Information field to 104 (the size of the buffer passed in), set QueryFile.Length to 0, and pass back the actual length of the file name in the NameInformation.FileNameLength variable. I return STATUS_BUFFER_OVERFLOW. I think I’m doing the same as in cdfs and fastfat. Does this all seem right to you?
McDonald’s informed me that I “don’t possess the manual dexterity required to become a truly great burger flipper”, so I guess it is fortunate that I do have a copy of the IFS kit. (It’s the 1997, Windows NT vintage. The bean counters aren’t ready to shell out another Grand for the XP version.)
Mr. Craig, I’m very glad that you were bored yesterday. (My gain!) Good point about STATUS_BUFFER_OVERFLOW being a warning, rather than an ‘error level’ status. I just wish I knew of a way to break this news to NotePad!
I may be completely wrong about this being the cause of the problem I’m seeing, but nothing else stands out. Any other ideas or advice?
Finally, I apologize for the previous message subject. I know better. I go now to seek the appropriate flogging. 8-(
Thanks again.
Jeff Nygren
-----Original Message-----
Subject: RE: ntfsd digest: March 23, 2003
From: xxxxx@KrollOntrack.com
…
When I try to open a file with NotePad, I get a “Not enough
memory available to complete the operation…” error message
(on Win2K). Task manager shows virtually no change in the
memory usage. My driver gets an IRP_MJ_QUERY_INFORMATION
request with a FileInformationClass value of
‘FileAllInformation’. The buffer size passed in (current
stack -> Parameters.QueryFile.Length) is the size of the
FILE_ALL_INFORMATION structure, which leaves no room for the
…
Jeff Nygren
Subject: RE: ntfsd digest: March 23, 2003
From: “Alexei Jelvis”
…
> In case of STATUS_BUFFER_OVERFLOW you need to fill as much
> information as
> it fits in output buffer and set Information field to the size of
> information you are returning. …
> ----------------------------------------------------------------------
>
> Subject: RE: ntfsd digest: March 23, 2003
> From: Dejan Maksimovic
> This seems to be a bit strange situation. When the
> FileAllInforamtion is required and no room is present for the
> filename, the I/O manager expects you to fill the rest of the
> structure, still AND return STATUS_BUFFER_OVERFLOW.
…
> ----------------------------------------------------------------------
>
> Subject: RE: ntfsd digest: March 23, 2003
> From: “Alexei Jelvis”
…
> There are two error codes related to insufficient output buffer:
> STATUS_BUFFER_OVERFLOW and STATUS_BUFFER_TOO_SMALL.
> When driver returns STATUS_BUFFER_TOO_SMALL it means that no data is
> returned.
> When STATUS_BUFFER_OVERFLOW is returned it is usually means
> that returned
> data contains some information that allows to deduce required
> size of the
> buffer - in case of FileAllInforamtion it is FileNameLength.
> Normally STATUS_BUFFER_OVERFLOW is supposed to be returned
> when fixed size
> part of the output structure fits into the output buffer but
> variable size
> part doesn’t.
> ----------------------------------------------------------------------
>
> Subject: RE: ntfsd digest: March 23, 2003
> From: Randy Cook
…
> For this particular problem and others like it, the
> fastfat source included in the IFS kit is the best
> reference material. You can see exactly what the FAT
> driver does. The IFS Kit runs about $1000 US.
> ----------------------------------------------------------------------
> Subject: RE: ntfsd digest: March 23, 2003
> From: “David J. Craig”
…
> OK, I am bored and will try to answer some of the questions.
> Do you have
> the IFS Kit? If not, try working at McDonald’s or maybe
> writing drivers to
> support hardware devices. Have you looked at the value for
> STATUS_BUFFER_OVERFLOW? Notice that the two most significant
> contain a 10b
> (binary), which makes this a warning and not an error.
> Notepad probably
> expects data to be returned for whatever length of a valid
> buffer you were
> given. That means you must fill in all the regular fields,
> but not the name
> at the end. Maybe Notepad doesn’t care about the LFN, since
> he probably
> already knows what it is. Notepad uses the files it opens as
> memory mapped
> and the rules for them are considerable different than those opened
> normally.
If you have the NT/W2K version of the IFS Kit, you can upgrade for less than
$200. There are three versions of the kit, but the first NT version was
superceded by the NT/W2K combo version. There are two XP IFS Kits, but the
SP1 version is the most important.
I see from the code in FastFat that the FileAllInformation structure
contains 9 other structures. It appears that some of the are also optional.
The code shows a careful passing of the length as reduced by the fixed part
of the structure to each routine to fill in the other pieces. You will
probably not get this working without the IFS kit for the version of the OS
you are trying to handle. The XP IFS Kit does contain an updated W2K kit
that includes all fixes since the earlier NT4/W2K combo was released. It
also includes the compiler that you should use. The only problem with it is
that it contains the entire DDK and will not install if it sees a XP DDK
already installed.
I would check the length and see how many of the items you should be
providing. Hard to so without the sources. I am looking at the combo
version of FastFat and haven’t looked into the XP SP1 source code yet.
----- Original Message -----
From:
To: “File Systems Developers”
Sent: Tuesday, March 25, 2003 1:23 PM
Subject: [ntfsd] Query - FileAllInformation (was RE: ntfsd digest…)
> Thank you all for your help! I appreciate it a lot.
>
> When I get the FileAllInformation query with QueryFile.Length set to
sizeof(FILE_ALL_INFORMATION), I fill in all the values in that structure,
except for NameInformation.FileName. I set IO_STATUS_BLOCK.Information field
to 104 (the size of the buffer passed in), set QueryFile.Length to 0, and
pass back the actual length of the file name in the
NameInformation.FileNameLength variable. I return STATUS_BUFFER_OVERFLOW. I
think I’m doing the same as in cdfs and fastfat. Does this all seem right to
you?
>
> McDonald’s informed me that I “don’t possess the manual dexterity required
to become a truly great burger flipper”, so I guess it is fortunate that I
do have a copy of the IFS kit. (It’s the 1997, Windows NT vintage. The bean
counters aren’t ready to shell out another Grand for the XP version.)
>
> Mr. Craig, I’m very glad that you were bored yesterday. (My gain!) Good
point about STATUS_BUFFER_OVERFLOW being a warning, rather than an ‘error
level’ status. I just wish I knew of a way to break this news to NotePad!
>
> I may be completely wrong about this being the cause of the problem I’m
seeing, but nothing else stands out. Any other ideas or advice?
>
> Finally, I apologize for the previous message subject. I know better. I go
now to seek the appropriate flogging. 8-(
>
> Thanks again.
>
> Jeff Nygren
>
> > -----Original Message-----
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: xxxxx@KrollOntrack.com
> …
> > When I try to open a file with NotePad, I get a “Not enough
> > memory available to complete the operation…” error message
> > (on Win2K). Task manager shows virtually no change in the
> > memory usage. My driver gets an IRP_MJ_QUERY_INFORMATION
> > request with a FileInformationClass value of
> > ‘FileAllInformation’. The buffer size passed in (current
> > stack -> Parameters.QueryFile.Length) is the size of the
> > FILE_ALL_INFORMATION structure, which leaves no room for the
> …
> > Jeff Nygren
> > ----------------------------------------------------------------------
> >
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: “Alexei Jelvis”
> …
> > In case of STATUS_BUFFER_OVERFLOW you need to fill as much
> > information as
> > it fits in output buffer and set Information field to the size of
> > information you are returning. …
> > ----------------------------------------------------------------------
> >
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: Dejan Maksimovic
> > This seems to be a bit strange situation. When the
> > FileAllInforamtion is required and no room is present for the
> > filename, the I/O manager expects you to fill the rest of the
> > structure, still AND return STATUS_BUFFER_OVERFLOW.
> …
> > ----------------------------------------------------------------------
> >
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: “Alexei Jelvis”
> …
> > There are two error codes related to insufficient output buffer:
> > STATUS_BUFFER_OVERFLOW and STATUS_BUFFER_TOO_SMALL.
> > When driver returns STATUS_BUFFER_TOO_SMALL it means that no data is
> > returned.
> > When STATUS_BUFFER_OVERFLOW is returned it is usually means
> > that returned
> > data contains some information that allows to deduce required
> > size of the
> > buffer - in case of FileAllInforamtion it is FileNameLength.
> > Normally STATUS_BUFFER_OVERFLOW is supposed to be returned
> > when fixed size
> > part of the output structure fits into the output buffer but
> > variable size
> > part doesn’t.
> > ----------------------------------------------------------------------
> >
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: Randy Cook
> …
> > For this particular problem and others like it, the
> > fastfat source included in the IFS kit is the best
> > reference material. You can see exactly what the FAT
> > driver does. The IFS Kit runs about $1000 US.
> > ----------------------------------------------------------------------
> > Subject: RE: ntfsd digest: March 23, 2003
> > From: “David J. Craig”
> …
> > OK, I am bored and will try to answer some of the questions.
> > Do you have
> > the IFS Kit? If not, try working at McDonald’s or maybe
> > writing drivers to
> > support hardware devices. Have you looked at the value for
> > STATUS_BUFFER_OVERFLOW? Notice that the two most significant
> > contain a 10b
> > (binary), which makes this a warning and not an error.
> > Notepad probably
> > expects data to be returned for whatever length of a valid
> > buffer you were
> > given. That means you must fill in all the regular fields,
> > but not the name
> > at the end. Maybe Notepad doesn’t care about the LFN, since
> > he probably
> > already knows what it is. Notepad uses the files it opens as
> > memory mapped
> > and the rules for them are considerable different than those opened
> > normally.
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@yoshimuni.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com