IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef


Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort.

Is this an idle system or a system under disk IO stress? If the latter then
you cannot expect any particular response time. If this is an idle system
then you have something fundamentally broken in your code. You should be
able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write
IPR requests
and sending them to the lower-level driver synchronously. The problem is
that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for
catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for
Read/Write IRP’s.

Thanks bef


Yahoo! for Good
Click http:</http:> here to donate to the
Hurricane Katrina relief effort. — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently
subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank
email to xxxxx@lists.osr.com

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the write dispatch routine before writing the actual data I’m reading data from the disk, writing it to sidestore sectors, then writing the actual data to the requested sectors. Can this be called an system under disk IO stress? maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to exclude pagefile’s sectors ). I know there’s no file objects in that level, but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:
Is this an idle system or a system under disk IO stress? If the latter then you cannot expect any particular response time. If this is an idle system then you have something fundamentally broken in your code. You should be able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

I’m still unclear if you are saying that every one of your IO’s takes one
second or more to complete or if some of your IOs take a huge amount of
time.

As for your other problem: yes you can find the sectors for the page files,
however it is probably not worth the effort. First you have to enumerate all
of the page files - easiest way to do this is through WMI in user mode. Then
for each page file you find the ‘disk extents’ for that page file. That
gives you the sector mapping for the page file. It is however a snapshot
view of the disk-to-pagefile mapping. Page files can extend themselves. New
page files can be added to the system. I ended up deciding that this was not
worth the effort of tracking simply for the benefit of avoiding replicating
the page file. Here is how to map files to disk sectors:
http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the
write dispatch routine before writing the actual data I’m reading data from
the disk, writing it to sidestore sectors, then writing the actual data to
the requested sectors. Can this be called an system under disk IO stress?
maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to
exclude pagefile’s sectors ). I know there’s no file objects in that level,
but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under disk IO stress? If the latter then
you cannot expect any particular response time. If this is an idle system
then you have something fundamentally broken in your code. You should be
able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write
IPR requests
and sending them to the lower-level driver synchronously. The problem is
that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for
catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for
Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate http:</http:> to the
Hurricane Katrina relief effort. — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently
subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank
email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed to
ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

Not all IO’s but most of them ( almost 90% ) take a huge amount of time. Almost after every Read/Write IRP I’m forced to wait for a big time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled. Seems that I/O Manager queuing IRP packets and serving my IRPs at last with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:
I’m still unclear if you are saying that every one of your IO’s takes one second or more to complete or if some of your IOs take a huge amount of time.

As for your other problem: yes you can find the sectors for the page files, however it is probably not worth the effort. First you have to enumerate all of the page files - easiest way to do this is through WMI in user mode. Then for each page file you find the ‘disk extents’ for that page file. That gives you the sector mapping for the page file. It is however a snapshot view of the disk-to-pagefile mapping. Page files can extend themselves. New page files can be added to the system. I ended up deciding that this was not worth the effort of tracking simply for the benefit of avoiding replicating the page file. Here is how to map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the write dispatch routine before writing the actual data I’m reading data from the disk, writing it to sidestore sectors, then writing the actual data to the requested sectors. Can this be called an system under disk IO stress? maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to exclude pagefile’s sectors ). I know there’s no file objects in that level, but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:
Is this an idle system or a system under disk IO stress? If the latter then you cannot expect any particular response time. If this is an idle system then you have something fundamentally broken in your code. You should be able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

Mark,

Is it really possible to map the pagefile? Wouldn’t the OS prevent
access to this file?

Thanks, MKE.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, September 14, 2005 4:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

I’m still unclear if you are saying that every one of your IO’s takes
one second or more to complete or if some of your IOs take a huge amount
of time.

As for your other problem: yes you can find the sectors for the page
files, however it is probably not worth the effort. First you have to
enumerate all of the page files - easiest way to do this is through WMI
in user mode. Then for each page file you find the ‘disk extents’ for
that page file. That gives you the sector mapping for the page file. It
is however a snapshot view of the disk-to-pagefile mapping. Page files
can extend themselves. New page files can be added to the system. I
ended up deciding that this was not worth the effort of tracking simply
for the benefit of avoiding replicating the page file. Here is how to
map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write
technology. In the write dispatch routine before writing the actual data
I’m reading data from the disk, writing it to sidestore sectors, then
writing the actual data to the requested sectors. Can this be called an
system under disk IO stress? maybe, as I’m protecting pagefile.sys too
… ( I have no idea on how to exclude pagefile’s sectors ). I know
there’s no file objects in that level, but maybe there is any way to get
the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under disk IO stress?
If the latter then you cannot expect any particular response time. If
this is an idle system then you have something fundamentally broken in
your code. You should be able to get 30MB/sec and several hundred
IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that
is creating the Read/Write IPR requests
and sending them to the lower-level driver
synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease the
delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

i suspect he’s talking about the mapping of file offset to physical
sectors, not memory mapping of the file.

-p


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eschmann, Michael
K
Sent: Wednesday, September 14, 2005 8:12 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Mark,

Is it really possible to map the pagefile? Wouldn’t the OS prevent
access to this file?

Thanks, MKE.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, September 14, 2005 4:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

I’m still unclear if you are saying that every one of your IO’s takes
one second or more to complete or if some of your IOs take a huge amount
of time.

As for your other problem: yes you can find the sectors for the page
files, however it is probably not worth the effort. First you have to
enumerate all of the page files - easiest way to do this is through WMI
in user mode. Then for each page file you find the ‘disk extents’ for
that page file. That gives you the sector mapping for the page file. It
is however a snapshot view of the disk-to-pagefile mapping. Page files
can extend themselves. New page files can be added to the system. I
ended up deciding that this was not worth the effort of tracking simply
for the benefit of avoiding replicating the page file. Here is how to
map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write
technology. In the write dispatch routine before writing the actual data
I’m reading data from the disk, writing it to sidestore sectors, then
writing the actual data to the requested sectors. Can this be called an
system under disk IO stress? maybe, as I’m protecting pagefile.sys too
… ( I have no idea on how to exclude pagefile’s sectors ). I know
there’s no file objects in that level, but maybe there is any way to get
the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under disk IO stress?
If the latter then you cannot expect any particular response time. If
this is an idle system then you have something fundamentally broken in
your code. You should be able to get 30MB/sec and several hundred
IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that
is creating the Read/Write IPR requests
and sending them to the lower-level driver
synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease the
delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

have you checked in your driver to see where the time is going? Is the
time being eaten during your copy? Or during the write to the original
sector that you do after the copy?

Have you broken into the system during this 1.5s stall to see what’s
happening and check the state of all the IRPs you’ve sent? Have you
added any profiling code to your driver?

-p


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge amount of time.
Almost after every Read/Write IRP I’m forced to wait for a big time (
min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled. Seems
that I/O Manager queuing IRP packets and serving my IRPs at last with
very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:

I’m still unclear if you are saying that every one of your IO’s
takes one second or more to complete or if some of your IOs take a huge
amount of time.

As for your other problem: yes you can find the sectors for the
page files, however it is probably not worth the effort. First you have
to enumerate all of the page files - easiest way to do this is through
WMI in user mode. Then for each page file you find the ‘disk extents’
for that page file. That gives you the sector mapping for the page file.
It is however a snapshot view of the disk-to-pagefile mapping. Page
files can extend themselves. New page files can be added to the system.
I ended up deciding that this was not worth the effort of tracking
simply for the benefit of avoiding replicating the page file. Here is
how to map files to disk sectors:
http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write
technology. In the write dispatch routine before writing the actual data
I’m reading data from the disk, writing it to sidestore sectors, then
writing the actual data to the requested sectors. Can this be called an
system under disk IO stress? maybe, as I’m protecting pagefile.sys too
… ( I have no idea on how to exclude pagefile’s sectors ). I know
there’s no file objects in that level, but maybe there is any way to get
the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under disk IO
stress? If the latter then you cannot expect any particular response
time. If this is an idle system then you have something fundamentally
broken in your code. You should be able to get 30MB/sec and several
hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53
AM
To: Windows System Software Devs
Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a
thread that is creating the Read/Write IPR requests
and sending them to the lower-level
driver synchronously. The problem is that after sending the Read/Write
IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease
the delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection
around
http://mail.yahoo.com — Questions? First check the
Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ
at http://www.osronline.com/article.cfm?id=256 You are currently
subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Yes Peter,

I’ve added profiling code. The time is eaten by IO manager. After sending IRPs my thread remains in waiting condition ( KeWaitForSingleObject ) waiting for my Event be signaled by IO manager. Here is my Read Function:

BOOLEAN

xxxFileLibRawRead(

IN XXX_FILE_HANDLE p_Handle,

OUT PVOID p_pBuffer,

IN ULONG p_uLength,

IN ULONGLONG p_ulPhysicalOffset

)

{

NTSTATUS v_ntStatus;

IO_STATUS_BLOCK v_ioStatusBlock;

KEVENT v_event;

LARGE_INTEGER v_ilByteOffset;

BOOLEAN v_bResult = TRUE;

LARGE_INTEGER timeStampStart;

LARGE_INTEGER timeStampComplete;

KeInitializeEvent( &v_event, NotificationEvent, FALSE );

v_ilByteOffset.QuadPart = p_ulPhysicalOffset;

v_ntStatus = xxxIRPLibRead(

p_Handle->m_DeviceObject,

p_Handle->m_TargetDeviceObject,

&v_event,

&v_ioStatusBlock,

(PVOID)p_pBuffer,

p_uLength,

&v_ilByteOffset

);

if (STATUS_PENDING == v_ntStatus)

{

xxxUtilGetClock(timeStampStart, NULL);

KeWaitForSingleObject(

&v_event,

Executive,

KernelMode,

FALSE,

NULL

);

xxxUtilGetClock(timeStampComplete, NULL);

DbgPrint(“\nRawRead %I64u\n”,timeStampComplete.QuadPart-timeStampStart.QuadPart);

}

if (!NT_SUCCESS(v_ntStatus))

{

DbgPrint(“\n*** ERROR: xxxFileLibRawRead (xxxIRPLibRead Failed)\n”);

v_bResult = FALSE;

}

else

{

DPRINT(DBG_TRACE_FILE_LIB,(“\nxxxFileLibRawRead (Read Succeed)\n”));

}

return v_bResult;

}
Thanks,
Zohrab.

Peter Wieland wrote:
have you checked in your driver to see where the time is going? Is the time being eaten during your copy? Or during the write to the original sector that you do after the copy?

Have you broken into the system during this 1.5s stall to see what’s happening and check the state of all the IRPs you’ve sent? Have you added any profiling code to your driver?

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge amount of time. Almost after every Read/Write IRP I’m forced to wait for a big time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled. Seems that I/O Manager queuing IRP packets and serving my IRPs at last with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:
I’m still unclear if you are saying that every one of your IO’s takes one second or more to complete or if some of your IOs take a huge amount of time.

As for your other problem: yes you can find the sectors for the page files, however it is probably not worth the effort. First you have to enumerate all of the page files - easiest way to do this is through WMI in user mode. Then for each page file you find the ‘disk extents’ for that page file. That gives you the sector mapping for the page file. It is however a snapshot view of the disk-to-pagefile mapping. Page files can extend themselves. New page files can be added to the system. I ended up deciding that this was not worth the effort of tracking simply for the benefit of avoiding replicating the page file. Here is how to map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the write dispatch routine before writing the actual data I’m reading data from the disk, writing it to sidestore sectors, then writing the actual data to the requested sectors. Can this be called an system under disk IO stress? maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to exclude pagefile’s sectors ). I know there’s no file objects in that level, but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:
Is this an idle system or a system under disk IO stress? If the latter then you cannot expect any particular response time. If this is an idle system then you have something fundamentally broken in your code. You should be able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

When you said your thread was stuck in a wait on an event i assumed you
ment the user-mode thread that issued the write to begin with. Not your
driver.

You should not do synchronous waits in the read & write path - it’s a
very bad idea. Especially if you’re doing COW for paging I/O.

You need to do this asynchronously. You’ve probably got three stages if
we ignore errors - read original data, write original data to new block,
write new data to original block. Each of these can be done
asynchronously by setting up the next stack location in the IRP you
received, setting a completion routine, issuing it to the appropriate
driver and then returning the status that IoCallDriver returns. In the
completion routine you perform the next step and return
STATUS_MORE_PROCESSING_REQUIRED until you’re out of things to do.

-p


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 11:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Yes Peter,

I’ve added profiling code. The time is eaten by IO manager. After
sending IRPs my thread remains in waiting condition (
KeWaitForSingleObject ) waiting for my Event be signaled by IO manager.
Here is my Read Function:

BOOLEAN

xxxFileLibRawRead(

IN XXX_FILE_HANDLE p_Handle,

OUT PVOID p_pBuffer,

IN ULONG p_uLength,

IN ULONGLONG p_ulPhysicalOffset

)

{

NTSTATUS v_ntStatus;

IO_STATUS_BLOCK v_ioStatusBlock;

KEVENT v_event;

LARGE_INTEGER v_ilByteOffset;

BOOLEAN v_bResult = TRUE;

LARGE_INTEGER timeStampStart;

LARGE_INTEGER timeStampComplete;

KeInitializeEvent( &v_event, NotificationEvent, FALSE );

v_ilByteOffset.QuadPart = p_ulPhysicalOffset;

v_ntStatus = xxxIRPLibRead(

p_Handle->m_DeviceObject,

p_Handle->m_TargetDeviceObject,

&v_event,

&v_ioStatusBlock,

(PVOID)p_pBuffer,

p_uLength,

&v_ilByteOffset

);

if (STATUS_PENDING == v_ntStatus)

{

xxxUtilGetClock(timeStampStart, NULL);

KeWaitForSingleObject(

&v_event,

Executive,

KernelMode,

FALSE,

NULL

);

xxxUtilGetClock(timeStampComplete, NULL);

DbgPrint(“\nRawRead
%I64u\n”,timeStampComplete.QuadPart-timeStampStart.QuadPart);

}

if (!NT_SUCCESS(v_ntStatus))

{

DbgPrint(“\n*** ERROR: xxxFileLibRawRead (xxxIRPLibRead Failed)\n”);

v_bResult = FALSE;

}

else

{

DPRINT(DBG_TRACE_FILE_LIB,(“\nxxxFileLibRawRead (Read Succeed)\n”));

}

return v_bResult;

}

Thanks,
Zohrab.

Peter Wieland wrote:

have you checked in your driver to see where the time is going?
Is the time being eaten during your copy? Or during the write to the
original sector that you do after the copy?

Have you broken into the system during this 1.5s stall to see
what’s happening and check the state of all the IRPs you’ve sent? Have
you added any profiling code to your driver?

-p



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge amount
of time. Almost after every Read/Write IRP I’m forced to wait for a big
time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled.
Seems that I/O Manager queuing IRP packets and serving my IRPs at last
with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:

I’m still unclear if you are saying that every one of
your IO’s takes one second or more to complete or if some of your IOs
take a huge amount of time.

As for your other problem: yes you can find the sectors
for the page files, however it is probably not worth the effort. First
you have to enumerate all of the page files - easiest way to do this is
through WMI in user mode. Then for each page file you find the ‘disk
extents’ for that page file. That gives you the sector mapping for the
page file. It is however a snapshot view of the disk-to-pagefile
mapping. Page files can extend themselves. New page files can be added
to the system. I ended up deciding that this was not worth the effort of
tracking simply for the benefit of avoiding replicating the page file.
Here is how to map files to disk sectors:
http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using
copy-on-write technology. In the write dispatch routine before writing
the actual data I’m reading data from the disk, writing it to sidestore
sectors, then writing the actual data to the requested sectors. Can this
be called an system under disk IO stress? maybe, as I’m protecting
pagefile.sys too … ( I have no idea on how to exclude pagefile’s
sectors ). I know there’s no file objects in that level, but maybe there
is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under
disk IO stress? If the latter then you cannot expect any particular
response time. If this is an idle system then you have something
fundamentally broken in your code. You should be able to get 30MB/sec
and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53
AM
To: Windows System Software Devs
Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a
thread that is creating the Read/Write IPR requests
and sending them to the lower-level
driver synchronously. The problem is that after sending the Read/Write
IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease
the delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver
FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev
as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam
protection around
http://mail.yahoo.com — Questions? First check
the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You
are currently subscribed to ntdev as: xxxxx@hollistech.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@windows.microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ
at http://www.osronline.com/article.cfm?id=256 You are currently
subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Yeah - this is just about the file offset to disk LBA mapping and that
can be done on any file. Theoretically a replication service could
ignore pagefile read/writes by noting the LBA.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Peter Wieland
Sent: Wednesday, September 14, 2005 12:51 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

i suspect he’s talking about the mapping of file offset to physical
sectors, not memory mapping of the file.

-p


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Eschmann, Michael
K
Sent: Wednesday, September 14, 2005 8:12 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Mark,

Is it really possible to map the pagefile? Wouldn’t the OS prevent
access to this file?

Thanks, MKE.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Wednesday, September 14, 2005 4:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

I’m still unclear if you are saying that every one of your IO’s takes
one second or more to complete or if some of your IOs take a huge amount
of time.

As for your other problem: yes you can find the sectors for the page
files, however it is probably not worth the effort. First you have to
enumerate all of the page files - easiest way to do this is through WMI
in user mode. Then for each page file you find the ‘disk extents’ for
that page file. That gives you the sector mapping for the page file. It
is however a snapshot view of the disk-to-pagefile mapping. Page files
can extend themselves. New page files can be added to the system. I
ended up deciding that this was not worth the effort of tracking simply
for the benefit of avoiding replicating the page file. Here is how to
map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,

Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write
technology. In the write dispatch routine before writing the actual data
I’m reading data from the disk, writing it to sidestore sectors, then
writing the actual data to the requested sectors. Can this be called an
system under disk IO stress? maybe, as I’m protecting pagefile.sys too
… ( I have no idea on how to exclude pagefile’s sectors ). I know
there’s no file objects in that level, but maybe there is any way to get
the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under disk IO stress?
If the latter then you cannot expect any particular response time. If
this is an idle system then you have something fundamentally broken in
your code. You should be able to get 30MB/sec and several hundred
IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,

I have the following problem:
In the Disk Filter Driver I have a thread that
is creating the Read/Write IPR requests
and sending them to the lower-level driver
synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease the
delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe
send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks for your suggestion Peter,

My thread is working in kernel-mode. All Write requests that comes from user level applications are pushed into thread’s queue form write Dispatch function. Then thread pops these IRPs from queue and doing COW and then sending them to next lower-level driver. The original data on the disk should not be overriten until I copy them, that is why I’m doing synchronous IO. I have to read the original data from the disk before sending the requested Write IRP to next lower-level driver. Can this be done with asynchronous IO operations ?
If I send asynchronous Read IRP, then Write IRP - does IO manager keep the order of requested operations ? Can I be sure that the original data will be read from the disk ?

Many thanks,

Zohrab.

Peter Wieland wrote:
When you said your thread was stuck in a wait on an event i assumed you ment the user-mode thread that issued the write to begin with. Not your driver.

You should not do synchronous waits in the read & write path - it’s a very bad idea. Especially if you’re doing COW for paging I/O.

You need to do this asynchronously. You’ve probably got three stages if we ignore errors - read original data, write original data to new block, write new data to original block. Each of these can be done asynchronously by setting up the next stack location in the IRP you received, setting a completion routine, issuing it to the appropriate driver and then returning the status that IoCallDriver returns. In the completion routine you perform the next step and return STATUS_MORE_PROCESSING_REQUIRED until you’re out of things to do.

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 11:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Yes Peter,

I’ve added profiling code. The time is eaten by IO manager. After sending IRPs my thread remains in waiting condition ( KeWaitForSingleObject ) waiting for my Event be signaled by IO manager. Here is my Read Function:

BOOLEAN

xxxFileLibRawRead(

IN XXX_FILE_HANDLE p_Handle,

OUT PVOID p_pBuffer,

IN ULONG p_uLength,

IN ULONGLONG p_ulPhysicalOffset

)

{

NTSTATUS v_ntStatus;

IO_STATUS_BLOCK v_ioStatusBlock;

KEVENT v_event;

LARGE_INTEGER v_ilByteOffset;

BOOLEAN v_bResult = TRUE;

LARGE_INTEGER timeStampStart;

LARGE_INTEGER timeStampComplete;

KeInitializeEvent( &v_event, NotificationEvent, FALSE );

v_ilByteOffset.QuadPart = p_ulPhysicalOffset;

v_ntStatus = xxxIRPLibRead(

p_Handle->m_DeviceObject,

p_Handle->m_TargetDeviceObject,

&v_event,

&v_ioStatusBlock,

(PVOID)p_pBuffer,

p_uLength,

&v_ilByteOffset

);

if (STATUS_PENDING == v_ntStatus)

{

xxxUtilGetClock(timeStampStart, NULL);

KeWaitForSingleObject(

&v_event,

Executive,

KernelMode,

FALSE,

NULL

);

xxxUtilGetClock(timeStampComplete, NULL);

DbgPrint(“\nRawRead %I64u\n”,timeStampComplete.QuadPart-timeStampStart.QuadPart);

}

if (!NT_SUCCESS(v_ntStatus))

{

DbgPrint(“\n*** ERROR: xxxFileLibRawRead (xxxIRPLibRead Failed)\n”);

v_bResult = FALSE;

}

else

{

DPRINT(DBG_TRACE_FILE_LIB,(“\nxxxFileLibRawRead (Read Succeed)\n”));

}

return v_bResult;

}
Thanks,
Zohrab.

Peter Wieland wrote:
have you checked in your driver to see where the time is going? Is the time being eaten during your copy? Or during the write to the original sector that you do after the copy?

Have you broken into the system during this 1.5s stall to see what’s happening and check the state of all the IRPs you’ve sent? Have you added any profiling code to your driver?

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge amount of time. Almost after every Read/Write IRP I’m forced to wait for a big time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled. Seems that I/O Manager queuing IRP packets and serving my IRPs at last with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:
I’m still unclear if you are saying that every one of your IO’s takes one second or more to complete or if some of your IOs take a huge amount of time.

As for your other problem: yes you can find the sectors for the page files, however it is probably not worth the effort. First you have to enumerate all of the page files - easiest way to do this is through WMI in user mode. Then for each page file you find the ‘disk extents’ for that page file. That gives you the sector mapping for the page file. It is however a snapshot view of the disk-to-pagefile mapping. Page files can extend themselves. New page files can be added to the system. I ended up deciding that this was not worth the effort of tracking simply for the benefit of avoiding replicating the page file. Here is how to map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the write dispatch routine before writing the actual data I’m reading data from the disk, writing it to sidestore sectors, then writing the actual data to the requested sectors. Can this be called an system under disk IO stress? maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to exclude pagefile’s sectors ). I know there’s no file objects in that level, but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:
Is this an idle system or a system under disk IO stress? If the latter then you cannot expect any particular response time. If this is an idle system then you have something fundamentally broken in your code. You should be able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort.

anything you can do with synchronous operations you can do with
asynchronous operations. But you need to maintain the order of
operations yourself.

Let’s take the simple case you’re describing below. If you’re
processing an outstanding I/O already you mark the new one pending, push
it into a queue (this removes all parallelism in storage, which is where
you get performance, so it’s not a great idea, but we’ll keep it for
now) and return status_pending. If you are idle then you mark that
you’re no longer idle and process the request. KDEVICE_QUEUEs are
adapted for just this purpose and help keep track of whether the queue
is idle or busy - read the DDK documentation about them.

When you process a request to write to sector A you do the following:

1 - Allocate some memory to keep track of the state of the request.
This would include the buffer you need to read A, a location to store
the original MDL and write parameters, etc…
2 - Use the IRP you got to do an asynchronous read of A. Return control
to the calling thread.
3 - in the completion routine issue an asynchronous write to A’.
4 - in the next completion routine, issue an asynchronous write to A
5 - in the next completion routine start the next write sequence and
then let the irp you’re processing complete.

The I/O manager will not do anything to maintain the order of read
operations with respect to tehse writes, but then again it’s not doing
that in the model you’re using either. There is no guarantee of
operation order in NT - if a read and a write (or two writes) race
against each other the result of the read is indeterminate. if two
writes racec against each other the result of the write is
indeterminate. If the client feels order of operations is important
then it should perform the N operations sequentially (but not
necessarily synchronously).

Now as to the lack of parallelism - you might want to do something about
that since you’re going to slow things down a lot. You could allow any
N write operations that don’t overlap to run in parallel (this is easier
when you don’t have your worker thread). You may even be able to allow
overlapping writes to run in parallel (since the result is indeterminate
as i stated above) - as long as you block the second write until the
read for the first one has completed.

It’s early for me - i hope this makes sense.

-p


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Thursday, September 15, 2005 12:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Thanks for your suggestion Peter,

My thread is working in kernel-mode. All Write requests that comes from
user level applications are pushed into thread’s queue form write
Dispatch function. Then thread pops these IRPs from queue and doing COW
and then sending them to next lower-level driver. The original data on
the disk should not be overriten until I copy them, that is why I’m
doing synchronous IO. I have to read the original data from the disk
before sending the requested Write IRP to next lower-level driver. Can
this be done with asynchronous IO operations ?
If I send asynchronous Read IRP, then Write IRP - does IO manager keep
the order of requested operations ? Can I be sure that the original data
will be read from the disk ?

Many thanks,

Zohrab.

Peter Wieland wrote:

When you said your thread was stuck in a wait on an event i
assumed you ment the user-mode thread that issued the write to begin
with. Not your driver.

You should not do synchronous waits in the read & write path -
it’s a very bad idea. Especially if you’re doing COW for paging I/O.

You need to do this asynchronously. You’ve probably got three
stages if we ignore errors - read original data, write original data to
new block, write new data to original block. Each of these can be done
asynchronously by setting up the next stack location in the IRP you
received, setting a completion routine, issuing it to the appropriate
driver and then returning the status that IoCallDriver returns. In the
completion routine you perform the next step and return
STATUS_MORE_PROCESSING_REQUIRED until you’re out of things to do.

-p



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 11:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Yes Peter,

I’ve added profiling code. The time is eaten by IO manager.
After sending IRPs my thread remains in waiting condition (
KeWaitForSingleObject ) waiting for my Event be signaled by IO manager.
Here is my Read Function:

BOOLEAN

xxxFileLibRawRead(

IN XXX_FILE_HANDLE p_Handle,

OUT PVOID p_pBuffer,

IN ULONG p_uLength,

IN ULONGLONG p_ulPhysicalOffset

)

{

NTSTATUS v_ntStatus;

IO_STATUS_BLOCK v_ioStatusBlock;

KEVENT v_event;

LARGE_INTEGER v_ilByteOffset;

BOOLEAN v_bResult = TRUE;

LARGE_INTEGER timeStampStart;

LARGE_INTEGER timeStampComplete;

KeInitializeEvent( &v_event, NotificationEvent, FALSE );

v_ilByteOffset.QuadPart = p_ulPhysicalOffset;

v_ntStatus = xxxIRPLibRead(

p_Handle->m_DeviceObject,

p_Handle->m_TargetDeviceObject,

&v_event,

&v_ioStatusBlock,

(PVOID)p_pBuffer,

p_uLength,

&v_ilByteOffset

);

if (STATUS_PENDING == v_ntStatus)

{

xxxUtilGetClock(timeStampStart, NULL);

KeWaitForSingleObject(

&v_event,

Executive,

KernelMode,

FALSE,

NULL

);

xxxUtilGetClock(timeStampComplete, NULL);

DbgPrint(“\nRawRead
%I64u\n”,timeStampComplete.QuadPart-timeStampStart.QuadPart);

}

if (!NT_SUCCESS(v_ntStatus))

{

DbgPrint(“\n*** ERROR: xxxFileLibRawRead (xxxIRPLibRead
Failed)\n”);

v_bResult = FALSE;

}

else

{

DPRINT(DBG_TRACE_FILE_LIB,(“\nxxxFileLibRawRead (Read
Succeed)\n”));

}

return v_bResult;

}

Thanks,
Zohrab.

Peter Wieland wrote:

have you checked in your driver to see where the time is
going? Is the time being eaten during your copy? Or during the write
to the original sector that you do after the copy?

Have you broken into the system during this 1.5s stall
to see what’s happening and check the state of all the IRPs you’ve sent?
Have you added any profiling code to your driver?

-p



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge
amount of time. Almost after every Read/Write IRP I’m forced to wait for
a big time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become
signaled. Seems that I/O Manager queuing IRP packets and serving my IRPs
at last with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:

I’m still unclear if you are saying that every
one of your IO’s takes one second or more to complete or if some of your
IOs take a huge amount of time.

As for your other problem: yes you can find the
sectors for the page files, however it is probably not worth the effort.
First you have to enumerate all of the page files - easiest way to do
this is through WMI in user mode. Then for each page file you find the
‘disk extents’ for that page file. That gives you the sector mapping for
the page file. It is however a snapshot view of the disk-to-pagefile
mapping. Page files can extend themselves. New page files can be added
to the system. I ended up deciding that this was not worth the effort of
tracking simply for the benefit of avoiding replicating the page file.
Here is how to map files to disk sectors:
http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14
AM
To: Windows System Software Devs
Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors
using copy-on-write technology. In the write dispatch routine before
writing the actual data I’m reading data from the disk, writing it to
sidestore sectors, then writing the actual data to the requested
sectors. Can this be called an system under disk IO stress? maybe, as
I’m protecting pagefile.sys too … ( I have no idea on how to exclude
pagefile’s sectors ). I know there’s no file objects in that level, but
maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:

Is this an idle system or a system under
disk IO stress? If the latter then you cannot expect any particular
response time. If this is an idle system then you have something
fundamentally broken in your code. You should be able to get 30MB/sec
and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com



From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53
AM
To: Windows System Software Devs
Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a
thread that is creating the Read/Write IPR requests
and sending them to the lower-level
driver synchronously. The problem is that after sending the Read/Write
IRP
thread staying in the pending state
(WaitForSingleObject) for catastrophically big time interval ( more than
1 sec. )
Could you please advise how to decrease
the delivery time interval for Read/Write IRP’s.

Thanks bef



Yahoo! for Good
Click here to donate
http:</http:> to the Hurricane Katrina
relief effort. — Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver
FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev
as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

__________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best
spam protection around
http://mail.yahoo.com — Questions?
First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256 You are currently subscribed
to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection
around
http://mail.yahoo.com — Questions? First check the
Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@windows.microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown
lmsubst tag argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@windows.microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to
xxxxx@lists.osr.com

________________________________

Yahoo! for Good
Click here to donate http:</http:> to the
Hurricane Katrina relief effort. — Questions? First check the Kernel
Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are
currently subscribed to ntdev as: xxxxx@windows.microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Many thanks Peter,

I’ll do as you advised and let you know…

Zohrab.

Peter Wieland wrote:
anything you can do with synchronous operations you can do with asynchronous operations. But you need to maintain the order of operations yourself.

Let’s take the simple case you’re describing below. If you’re processing an outstanding I/O already you mark the new one pending, push it into a queue (this removes all parallelism in storage, which is where you get performance, so it’s not a great idea, but we’ll keep it for now) and return status_pending. If you are idle then you mark that you’re no longer idle and process the request. KDEVICE_QUEUEs are adapted for just this purpose and help keep track of whether the queue is idle or busy - read the DDK documentation about them.

When you process a request to write to sector A you do the following:

1 - Allocate some memory to keep track of the state of the request. This would include the buffer you need to read A, a location to store the original MDL and write parameters, etc…
2 - Use the IRP you got to do an asynchronous read of A. Return control to the calling thread.
3 - in the completion routine issue an asynchronous write to A’.
4 - in the next completion routine, issue an asynchronous write to A
5 - in the next completion routine start the next write sequence and then let the irp you’re processing complete.

The I/O manager will not do anything to maintain the order of read operations with respect to tehse writes, but then again it’s not doing that in the model you’re using either. There is no guarantee of operation order in NT - if a read and a write (or two writes) race against each other the result of the read is indeterminate. if two writes racec against each other the result of the write is indeterminate. If the client feels order of operations is important then it should perform the N operations sequentially (but not necessarily synchronously).

Now as to the lack of parallelism - you might want to do something about that since you’re going to slow things down a lot. You could allow any N write operations that don’t overlap to run in parallel (this is easier when you don’t have your worker thread). You may even be able to allow overlapping writes to run in parallel (since the result is indeterminate as i stated above) - as long as you block the second write until the read for the first one has completed.

It’s early for me - i hope this makes sense.

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Thursday, September 15, 2005 12:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Thanks for your suggestion Peter,

My thread is working in kernel-mode. All Write requests that comes from user level applications are pushed into thread’s queue form write Dispatch function. Then thread pops these IRPs from queue and doing COW and then sending them to next lower-level driver. The original data on the disk should not be overriten until I copy them, that is why I’m doing synchronous IO. I have to read the original data from the disk before sending the requested Write IRP to next lower-level driver. Can this be done with asynchronous IO operations ?
If I send asynchronous Read IRP, then Write IRP - does IO manager keep the order of requested operations ? Can I be sure that the original data will be read from the disk ?

Many thanks,

Zohrab.

Peter Wieland wrote:
When you said your thread was stuck in a wait on an event i assumed you ment the user-mode thread that issued the write to begin with. Not your driver.

You should not do synchronous waits in the read & write path - it’s a very bad idea. Especially if you’re doing COW for paging I/O.

You need to do this asynchronously. You’ve probably got three stages if we ignore errors - read original data, write original data to new block, write new data to original block. Each of these can be done asynchronously by setting up the next stack location in the IRP you received, setting a completion routine, issuing it to the appropriate driver and then returning the status that IoCallDriver returns. In the completion routine you perform the next step and return STATUS_MORE_PROCESSING_REQUIRED until you’re out of things to do.

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 11:09 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Yes Peter,

I’ve added profiling code. The time is eaten by IO manager. After sending IRPs my thread remains in waiting condition ( KeWaitForSingleObject ) waiting for my Event be signaled by IO manager. Here is my Read Function:

BOOLEAN

xxxFileLibRawRead(

IN XXX_FILE_HANDLE p_Handle,

OUT PVOID p_pBuffer,

IN ULONG p_uLength,

IN ULONGLONG p_ulPhysicalOffset

)

{

NTSTATUS v_ntStatus;

IO_STATUS_BLOCK v_ioStatusBlock;

KEVENT v_event;

LARGE_INTEGER v_ilByteOffset;

BOOLEAN v_bResult = TRUE;

LARGE_INTEGER timeStampStart;

LARGE_INTEGER timeStampComplete;

KeInitializeEvent( &v_event, NotificationEvent, FALSE );

v_ilByteOffset.QuadPart = p_ulPhysicalOffset;

v_ntStatus = xxxIRPLibRead(

p_Handle->m_DeviceObject,

p_Handle->m_TargetDeviceObject,

&v_event,

&v_ioStatusBlock,

(PVOID)p_pBuffer,

p_uLength,

&v_ilByteOffset

);

if (STATUS_PENDING == v_ntStatus)

{

xxxUtilGetClock(timeStampStart, NULL);

KeWaitForSingleObject(

&v_event,

Executive,

KernelMode,

FALSE,

NULL

);

xxxUtilGetClock(timeStampComplete, NULL);

DbgPrint(“\nRawRead %I64u\n”,timeStampComplete.QuadPart-timeStampStart.QuadPart);

}

if (!NT_SUCCESS(v_ntStatus))

{

DbgPrint(“\n*** ERROR: xxxFileLibRawRead (xxxIRPLibRead Failed)\n”);

v_bResult = FALSE;

}

else

{

DPRINT(DBG_TRACE_FILE_LIB,(“\nxxxFileLibRawRead (Read Succeed)\n”));

}

return v_bResult;

}
Thanks,
Zohrab.

Peter Wieland wrote:
have you checked in your driver to see where the time is going? Is the time being eaten during your copy? Or during the write to the original sector that you do after the copy?

Have you broken into the system during this 1.5s stall to see what’s happening and check the state of all the IRPs you’ve sent? Have you added any profiling code to your driver?

-p

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 5:22 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Not all IO’s but most of them ( almost 90% ) take a huge amount of time. Almost after every Read/Write IRP I’m forced to wait for a big time ( min 0.5 ml Sec, up to 1.5 Sec. ) for my Event to become signaled. Seems that I/O Manager queuing IRP packets and serving my IRPs at last with very low priority.

Thanks for your Great article,

Zohrab.

Mark Roddy wrote:
I’m still unclear if you are saying that every one of your IO’s takes one second or more to complete or if some of your IOs take a huge amount of time.

As for your other problem: yes you can find the sectors for the page files, however it is probably not worth the effort. First you have to enumerate all of the page files - easiest way to do this is through WMI in user mode. Then for each page file you find the ‘disk extents’ for that page file. That gives you the sector mapping for the page file. It is however a snapshot view of the disk-to-pagefile mapping. Page files can extend themselves. New page files can be added to the system. I ended up deciding that this was not worth the effort of tracking simply for the benefit of avoiding replicating the page file. Here is how to map files to disk sectors: http://www.wd-3.com/archive/luserland.htm

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Wednesday, September 14, 2005 2:14 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] IRP Timing problem

Hi Mark,
Thanks for your quick response.

Actually I’m protecting disk sectors using copy-on-write technology. In the write dispatch routine before writing the actual data I’m reading data from the disk, writing it to sidestore sectors, then writing the actual data to the requested sectors. Can this be called an system under disk IO stress? maybe, as I’m protecting pagefile.sys too … ( I have no idea on how to exclude pagefile’s sectors ). I know there’s no file objects in that level, but maybe there is any way to get the file object by sector numbers ?

Zohrab Broyan.

Mark Roddy wrote:
Is this an idle system or a system under disk IO stress? If the latter then you cannot expect any particular response time. If this is an idle system then you have something fundamentally broken in your code. You should be able to get 30MB/sec and several hundred IOs/sec without trying.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

---------------------------------
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Zohrab Broyan
Sent: Tuesday, September 13, 2005 10:53 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] IRP Timing problem

Hello all,
I have the following problem:
In the Disk Filter Driver I have a thread that is creating the Read/Write IPR requests
and sending them to the lower-level driver synchronously. The problem is that after sending the Read/Write IRP
thread staying in the pending state (WaitForSingleObject) for catastrophically big time interval ( more than 1 sec. )
Could you please advise how to decrease the delivery time interval for Read/Write IRP’s.

Thanks bef

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@hollistech.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort. — Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256 You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

---------------------------------
Yahoo! for Good
Click here to donate to the Hurricane Katrina relief effort.