Volume Size in the kernel

NTDEV
1

Hi,
Sitting as upper filter driver to volume devices, I
want to determine the volume size as early as possible
( before any actual I/O happens on the volume). Whats
the best way to do this? Also, I want to trap any
changes in volume size, format etc.

Thanks

Start your day with Yahoo! - make it your home page
http://www.yahoo.com/r/hs

2

That is not possible. The lower parts of the disk stack will have done some
I/O to the drive(s) long before the volume manager gets involved. Even much
earlier for the boot & system drives.

“krnl_drv” wrote in message news:xxxxx@ntdev…
> Hi,
> Sitting as upper filter driver to volume devices, I
> want to determine the volume size as early as possible
> ( before any actual I/O happens on the volume). Whats
> the best way to do this? Also, I want to trap any
> changes in volume size, format etc.
>
> Thanks
>
>
>
>
> ____________________________________________________
> Start your day with Yahoo! - make it your home page
> http://www.yahoo.com/r/hs
>
>

3

Thanks for your reply. I am sorry for being not very
specific. I am not concerned with all I/O, I am just
looking at writes which may have happened to the
Volume device( Basically from FS above). I am also not
concerned with I/O happening to other location on disk
like Volume Manager configuration, MBR etc.

— “David J. Craig” wrote:

> That is not possible. The lower parts of the disk
> stack will have done some
> I/O to the drive(s) long before the volume manager
> gets involved. Even much
> earlier for the boot & system drives.
>
> “krnl_drv” wrote in message
> news:xxxxx@ntdev…
> > Hi,
> > Sitting as upper filter driver to volume devices,
> I
> > want to determine the volume size as early as
> possible
> > ( before any actual I/O happens on the volume).
> Whats
> > the best way to do this? Also, I want to trap any
> > changes in volume size, format etc.
> >
> > Thanks
> >
> >
> >
> >
> >
> __________________
> > Start your day with Yahoo! - make it your home
> page
> > http://www.yahoo.com/r/hs
> >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>


Yahoo! Mail
Stay connected, organized, and protected. Take the tour:
http://tour.mail.yahoo.com/mailtour.html

4

It is possible to get something like ‘volume size’ in the kernel - you read
the partition table. Of course this is only “something like volume size” -
for example if your disk is an LDM disk the whole disk is occupied by the
LDM partition and the volume size is obscured. Then there is the small
problem of correlating partition table information with volume device.

See IoReadPartitionTableEx in the DDK. Note however that the implementation
of this function may be quite ugly for you if you are calling it in the disk
stack itself. However, that sort of complication is what makes this fun.

Also you should be able to get lots of information about the volume before
anyone gets to write it, it is just reading that will happen as the storage
stack is constructed.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of krnl_drv
Sent: Thursday, August 04, 2005 1:53 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] Volume Size in the kernel

Thanks for your reply. I am sorry for being not very
specific. I am not concerned with all I/O, I am just looking
at writes which may have happened to the Volume device(
Basically from FS above). I am also not concerned with I/O
happening to other location on disk like Volume Manager
configuration, MBR etc.

— “David J. Craig” wrote:
>
> > That is not possible. The lower parts of the disk stack will have
> > done some I/O to the drive(s) long before the volume manager gets
> > involved. Even much earlier for the boot & system drives.
> >
> > “krnl_drv” wrote in message news:xxxxx@ntdev…
> > > Hi,
> > > Sitting as upper filter driver to volume devices,
> > I
> > > want to determine the volume size as early as
> > possible
> > > ( before any actual I/O happens on the volume).
> > Whats
> > > the best way to do this? Also, I want to trap any
> changes in volume
> > > size, format etc.
> > >
> > > Thanks
> > >
> > >
> > >
> > >
> > >
> > __________________
> > > Start your day with Yahoo! - make it your home
> > page
> > > http://www.yahoo.com/r/hs
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
>
>
>
>
> Yahoo! Mail
> Stay connected, organized, and protected. Take the tour:
> http://tour.mail.yahoo.com/mailtour.html
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@hollistech.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

5

Also - take a look at IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS as this provides
the actual volume layout on a per-physical disk basis and theoretically
works for all volume types. It has to be sent through the volume device,
which would mean that you could not use it until after the volume device is
started. A volume filter might be requried.

Knowing when the volume layout has changed is tricky. The approach I took is
to monitor the LBAs going to a physical disk and comparing their last sector
written to my known last sector allocated.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Thursday, August 04, 2005 10:29 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Volume Size in the kernel

It is possible to get something like ‘volume size’ in the
kernel - you read the partition table. Of course this is only
“something like volume size” - for example if your disk is an
LDM disk the whole disk is occupied by the LDM partition and
the volume size is obscured. Then there is the small problem
of correlating partition table information with volume device.

See IoReadPartitionTableEx in the DDK. Note however that the
implementation of this function may be quite ugly for you if
you are calling it in the disk stack itself. However, that
sort of complication is what makes this fun.

Also you should be able to get lots of information about the
volume before anyone gets to write it, it is just reading
that will happen as the storage stack is constructed.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032 www.hollistech.com

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of krnl_drv
> Sent: Thursday, August 04, 2005 1:53 PM
> To: Windows System Software Devs Interest List
> Subject: Re:[ntdev] Volume Size in the kernel
>
> Thanks for your reply. I am sorry for being not very specific. I am
> not concerned with all I/O, I am just looking at writes
which may have
> happened to the Volume device( Basically from FS above). I
am also not
> concerned with I/O happening to other location on disk like Volume
> Manager configuration, MBR etc.
>
> — “David J. Craig” wrote:
> >
> > > That is not possible. The lower parts of the disk stack
> will have
> > > done some I/O to the drive(s) long before the volume manager gets
> > > involved. Even much earlier for the boot & system drives.
> > >
> > > “krnl_drv” wrote in message
> news:xxxxx@ntdev…
> > > > Hi,
> > > > Sitting as upper filter driver to volume devices,
> > > I
> > > > want to determine the volume size as early as
> > > possible
> > > > ( before any actual I/O happens on the volume).
> > > Whats
> > > > the best way to do this? Also, I want to trap any
> > changes in volume
> > > > size, format etc.
> > > >
> > > > Thanks
> > > >
> > > >
> > > >
> > > >
> > > >
> > > __________________
> > > > Start your day with Yahoo! - make it your home
> > > page
> > > > http://www.yahoo.com/r/hs
> > > >
> > > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > > xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> > >
> >
> >
> >
> >
> >
> > Yahoo! Mail
> > Stay connected, organized, and protected. Take the tour:
> > http://tour.mail.yahoo.com/mailtour.html
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@hollistech.com To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@hollistech.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

6

Thanks Mark. As my dirver is a upper filter to
Storage/Volume class, I really don’t care about the
physical layout of the volumes. I am just intersted in
knowing the effective size of the volume which is
available for the FS/or any application. This size is
returned by IOCTL GET_PARTITION_INFO. One approach
could be monitor this call along with IOCTLS ( like
GROW_PARTION) etc.

Do you think this is a good approach?

— Mark Roddy wrote:

> Also - take a look at
> IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS as this
> provides
> the actual volume layout on a per-physical disk
> basis and theoretically
> works for all volume types. It has to be sent
> through the volume device,
> which would mean that you could not use it until
> after the volume device is
> started. A volume filter might be requried.
>
> Knowing when the volume layout has changed is
> tricky. The approach I took is
> to monitor the LBAs going to a physical disk and
> comparing their last sector
> written to my known last sector allocated.
>
> =====================
> Mark Roddy DDK MVP
> Windows 2003/XP/2000 Consulting
> Hollis Technology Solutions 603-321-1032
> www.hollistech.com
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On
> Behalf Of Mark Roddy
> > Sent: Thursday, August 04, 2005 10:29 PM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] Volume Size in the kernel
> >
> > It is possible to get something like ‘volume size’
> in the
> > kernel - you read the partition table. Of course
> this is only
> > “something like volume size” - for example if your
> disk is an
> > LDM disk the whole disk is occupied by the LDM
> partition and
> > the volume size is obscured. Then there is the
> small problem
> > of correlating partition table information with
> volume device.
> >
> > See IoReadPartitionTableEx in the DDK. Note
> however that the
> > implementation of this function may be quite ugly
> for you if
> > you are calling it in the disk stack itself.
> However, that
> > sort of complication is what makes this fun.
> >
> > Also you should be able to get lots of information
> about the
> > volume before anyone gets to write it, it is just
> reading
> > that will happen as the storage stack is
> constructed.
> >
> > =====================
> > Mark Roddy DDK MVP
> > Windows 2003/XP/2000 Consulting
> > Hollis Technology Solutions 603-321-1032
> www.hollistech.com
> >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On
> Behalf Of krnl_drv
> > > Sent: Thursday, August 04, 2005 1:53 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: Re:[ntdev] Volume Size in the kernel
> > >
> > > Thanks for your reply. I am sorry for being not
> very specific. I am
> > > not concerned with all I/O, I am just looking at
> writes
> > which may have
> > > happened to the Volume device( Basically from FS
> above). I
> > am also not
> > > concerned with I/O happening to other location
> on disk like Volume
> > > Manager configuration, MBR etc.
> > >
> > > — “David J. Craig”
> wrote:
> > >
> > > > That is not possible. The lower parts of the
> disk stack
> > will have
> > > > done some I/O to the drive(s) long before the
> volume manager gets
> > > > involved. Even much earlier for the boot &
> system drives.
> > > >
> > > > “krnl_drv” wrote in
> message
> > news:xxxxx@ntdev…
> > > > > Hi,
> > > > > Sitting as upper filter driver to volume
> devices,
> > > > I
> > > > > want to determine the volume size as early
> as
> > > > possible
> > > > > ( before any actual I/O happens on the
> volume).
> > > > Whats
> > > > > the best way to do this? Also, I want to
> trap any
> > > changes in volume
> > > > > size, format etc.
> > > > >
> > > > > Thanks
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >
> > > >
> __________________
> > > > > Start your day with Yahoo! - make it your
> home
> > > > page
> > > > > http://www.yahoo.com/r/hs
> > > > >
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ
> at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as:
> > > > xxxxx@yahoo.com
> > > > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > >
> > >
> > >
> > >
> > >
> > >
> > > Yahoo! Mail
> > > Stay connected, organized, and protected. Take
> the tour:
> > > http://tour.mail.yahoo.com/mailtour.html
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > > xxxxx@hollistech.com To unsubscribe send a blank
> email to
> > > xxxxx@lists.osr.com
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@hollistech.com To unsubscribe send a blank
> email to
> > xxxxx@lists.osr.com
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

7

> available for the FS/or any application. This size is

returned by IOCTL GET_PARTITION_INFO

Yes, a good idea, but there are nuances - the FS’s volume size can be a bit
smaller. For instance, NTFS formatter not only rounds the result of
GET_PARTITION_INFO down to a cluster, but is also noticed to subtract 1
cluster!

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com