Query about Volume manager object and IOCTL_GET_VOLUME_DISK_EXTENTS

josh · October 1, 2012, 11:24am

Hi,

I am sorry if this questions is already asked. I tried to read many posts here but this still confuses me.I am trying to get the physical location/s of a volume from a upper disk filter level (diskperf). As I understand we can get this information using IOCTL_GET_VOLUME_DISK_EXTENTS, and this request is handled by the “Volume manager” which is in a completely seperate stack. I’ve tried to create a IOCTL request (IoBuildDeviceIoControlRequest) and tried to send it directly to the volume (/device/harddiskVolume…) that I want to check. The object name was verfied from user space and this user space application calls a disfperf’s IOCTL. All my attempts to obtain a handle to the volume manager and send the DISK_EXTENT query has led to system crashes and the logs do not point to anything significant. Can somebody please point to what I’m doing wrong

Regards

josh · October 8, 2012, 11:15am

bump.

I am sorry if my last post was not clear. I guess the simplest way to ask it again is:

Is it is possible to issue a IOCTL_GET_VOLUME_DISK_EXTENTS from diskperf
How do i get the device object to send this request to

Regards

Don_Burn · October 8, 2012, 11:36am

What are you trying to accomplish by issuing _GET_VOLUME_DISK_EXTENTS?
Normally this is issued at a higher level, such as a volume or file
system filter.

Don Burn
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“xxxxx@coventry.ac.uk” wrote in message
news:xxxxx@ntdev:

> bump.
>
> I am sorry if my last post was not clear. I guess the simplest way to ask it again is:
>
> 1. Is it is possible to issue a IOCTL_GET_VOLUME_DISK_EXTENTS from diskperf
>
> 2. How do i get the device object to send this request to
>
> Regards

Peter_Viscarola_OSR · October 8, 2012, 11:43am

Good bump. And bravo for the patience of being willing to wait a week before you did so.,

Your question was clear to me… I just didn’t know what to say. And you didn’t really give me enough information to diagnose the specific problem you’re having. You said it crashed, but didn’t give us a crash code or the output from !analyze -v… You said the “logs don’t point to anything significant” – I’m not sure what a “log” is, but if you mean the crash dump, something is significant enough to crash the system, right?

So, basically, I can’t tell if you’re building the IOCTL incorrectly, or sending or managing it incorrectly. It’s most likely one of these, because sending a random IOCTL to a random location will almost certainly result in getting back an error status… not a system crash.

So, off hand, I’d say it’s HOW you’re building or sending/managing the IOCTL… not to whom you’re sending it… that’s the underlying problem. But that’s obviously a blind guess.

The IOCTL is IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS. It’s a Voume Manager IOCTL as you say.

If you’re an upper filter of DISK you’re BELOW the Volume Manager. Disks and Volumes don’t necessarily correspond 1 to 1, right? A single volume could be striped across multiple hard drives, or raided or whatever.

So, you need to send the request to something representing the VOLUME.

Does any of that help?

Peter
OSR

josh · October 9, 2012, 9:45am

Thank you for your replies.

@Ron: I am trying to build an API in which the user supplies a volume name and specifies the operations he wishes to perform. The operation could be anything like copying, reading, deleting data written on the fly. I?ve implemented the IRP changes for this in a disk filter but now I am trying to get the details of a volume at this level. I have the following questions regarding your reply.

Wouldn?t disk filter be the first to know whenever a disk is added or removed
Can I reuse the IRP manipulation code in the FS/Volume filter level
Would the volume filter be intimated when disk/ volume are individually added or removed

@Peter: Thank you for your reply it made me smile. I shall try to be a little more clear in this mail. These are the relevant lines from analyse ?v. The error I am getting is ?SYSTEM_SERVICE_EXCEPTION (3b)?. The exception code is ?(NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s?. The call stack is:
Ntfs!NtfsFsdDeviceControl+0x46
fltmgr!FltpDispatch+0x9f
SIoctl!symbol_name_to_obj+0x1d4 (Function where I make the IRP and call the driver)
SIoctl!SioctlDeviceControl+0x8a (My IOCTL callback)
nt!IopXxxControlFile+0x607
nt!NtDeviceIoControlFile+0x56
nt!KiSystemServiceCopyEnd+0x13
ntdll!ZwDeviceIoControlFile+0xa
KERNELBASE!DeviceIoControl+0x75
kernel32!DeviceIoControlImplementation+0x7f
extents+0x1d12

The logs indicate that it crashes at the ?IoCallDriver? call. The ?IoBuildDeviceIoControlRequest? was used to build the IRP for the IoCallDriver call and C: was the device to which it was it sent. Please tell me if you need any more information.

Regards

Peter_Viscarola_OSR · October 9, 2012, 10:06am

Looks to me like you’re not building the ioctl correctly… You most likely have a bad parameter.

Can you shows how you’re building that ioctl?

Peter
OSR

josh · October 9, 2012, 10:12am

Thank you for your reply. These are the lines:

pVolDskExtent = ExAllocatePoolWithTag (NonPagedPool, sizeof (VOLUME_DISK_EXTENTS) * 16, ‘1prI’);

RtlInitUnicodeString (&uStr, L"\Device\HarddiskVolume3");
status = IoGetDeviceObjectPointer (&uStr, FILE_READ_DATA, &pFileObj, &pSrcObj);

KeInitializeEvent( &event, NotificationEvent, FALSE);

pNewIrp = IoBuildDeviceIoControlRequest (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, pSrcObj, NULL, 0, pVolDskExtent, sizeof (VOLUME_DISK_EXTENTS), FALSE, &event, &IoStatus);

Atul · October 9, 2012, 1:31pm

You have allocated a buffer of 16*sizeof(volume_disk_extents) but you are
passing only sizeof(volume_disk_extents) in the IoBuildXXX API.

Anyways, if you think the volume could span 16 extents, your allocation
should be of the size

sizeof(volume_disk_extent) + 15*sizeof(disk_extent)

On Tue, Oct 9, 2012 at 7:45 PM, wrote:

> Thank you for your reply. These are the lines:
>
> pVolDskExtent = ExAllocatePoolWithTag (NonPagedPool, sizeof
> (VOLUME_DISK_EXTENTS) * 16, ‘1prI’);
>
> RtlInitUnicodeString (&uStr, L"\Device\HarddiskVolume3");
> status = IoGetDeviceObjectPointer (&uStr, FILE_READ_DATA, &pFileObj,
> &pSrcObj);
>
> KeInitializeEvent( &event, NotificationEvent, FALSE);
>
> pNewIrp = IoBuildDeviceIoControlRequest
> (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, pSrcObj, NULL, 0, pVolDskExtent,
> sizeof (VOLUME_DISK_EXTENTS), FALSE, &event, &IoStatus);
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

Doron_Holan · October 9, 2012, 2:09pm

> sizeof(volume_disk_extent) + 15*sizeof(disk_extent)

Umh, that is a bit convoluted. How about 16*sizeof(disk_extent)

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Atul Kabra
Sent: Tuesday, October 9, 2012 10:31 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Query about Volume manager object and IOCTL_GET_VOLUME_DISK_EXTENTS

You have allocated a buffer of 16*sizeof(volume_disk_extents) but you are passing only sizeof(volume_disk_extents) in the IoBuildXXX API.

Anyways, if you think the volume could span 16 extents, your allocation should be of the size

sizeof(volume_disk_extent) + 15*sizeof(disk_extent)

On Tue, Oct 9, 2012 at 7:45 PM, > wrote:
Thank you for your reply. These are the lines:

pVolDskExtent = ExAllocatePoolWithTag (NonPagedPool, sizeof (VOLUME_DISK_EXTENTS) * 16, ‘1prI’);

RtlInitUnicodeString (&uStr, L"\Device\HarddiskVolume3<file:>");
status = IoGetDeviceObjectPointer (&uStr, FILE_READ_DATA, &pFileObj, &pSrcObj);

KeInitializeEvent( &event, NotificationEvent, FALSE);

pNewIrp = IoBuildDeviceIoControlRequest (IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS, pSrcObj, NULL, 0, pVolDskExtent, sizeof (VOLUME_DISK_EXTENTS), FALSE, &event, &IoStatus);

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</file:>

Tim_Roberts · October 9, 2012, 3:07pm

Doron Holan wrote:

> sizeof(volume_disk_extent) + 15*sizeof(disk_extent)

Umh, that is a bit convoluted. How about 16*sizeof(disk_extent)

Actually, his code is correct. VOLUME_DISK_EXTENTS ends in a
variable-sized array that includes one DISK_EXTENT, so to get 16, you
need to add 15 more.

16*sizeof(DISK_EXTENT) would be too short.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Doron_Holan · October 9, 2012, 3:25pm

sorry, read too fast and didn’t see type names. my recommendation for the pattern of allocate an open ended array and then pass it is to compute the size once, pass it both to ExAllocatePool and then SendIo() so that there is no difference in the size allocated and the size describing the buffer size