Re: newbie: ExAllocatePoolWithTag

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Gary G. Little (gglittle.nospam_at_sbcglobal.net)
Date: 08/14/04 

Date: Sat, 14 Aug 2004 19:43:38 GMT

Rule of thumb for IRQL ... if you raise it, you can lower it. If your
DISPATCH routine is called at >= DISPATCH_LEVEL you cannot lower it, but you
should have a serious talk with they who called you at that level. If I am
not mistaken, Driver Verifier will catch you on this one if you do, and I
don't think the checked build will take kindly to this. Even if neither of
them do, when you return after lowering IRQL they who called you will most
likely fail and have a hell of debug problem until they knock on your door
asking why you changed their IRQL. 

-- 
The personal opinion of
Gary G. Little
"Don Burn" <burn@stopspam.acm.org> wrote in message
news:10hskhpnucfm5e8@corp.supernews.com...
> Well what is the situation that has you at DISPATCH_LEVEL?  Are you
holding
> a spinlock, and if so could you use a different synchronization mechanism?
> Are you doing something in a DPC routine and could you do it from a work
> item so you are at passive?
>
> -- 
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> Remove StopSpam from the email to reply
>
> "Sam Johnson" <SamJohnson@discussions.microsoft.com> wrote in message
> news:4236C48E-9ED8-48A6-BA10-89B44258F7E5@microsoft.com...
> > I need to store some amount of data for a short period of time (until a
> user
> > mode application 'collects' it from kernel mode). But as the size of the
> > whole data can is different every time, I thought I'd be better off when
I
> > allocate the whole stuff in paged memory, as this won't fail that
easily.
> > By the way, is there any way to lower the IRQL? I know there are
> appropriate
> > functions for this, but I've heard that this would be very dangerous
> > solution.....
> >
> >
> > What do you think?
> >
> > Sam Johnson
> >
> >
> >
> >
> >
> > "Don Burn" wrote:
> >
> > > Doron,
> > >
> > >      You're right, its been a long week.
> > >
> > > Don
> > >
> > > "Doron Holan [MS]" <doronh@nospam.microsoft.com> wrote in message
> > > news:OoMjoGigEHA.2916@TK2MSFTNGP12.phx.gbl...
> > > > i think don meant there is no way to allocate PagedPool at dispatch
> level
> > > > :).
> > > >
> > > > d
> > > >
> > > > -- 
> > > > Please do not send e-mail directly to this alias. this alias is for
> > > > newsgroup purposes only.
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > > rights.
> > > >
> > > >
> > > > "Don Burn" <burn@stopspam.acm.org> wrote in message
> > > > news:10hsh0q8t9a9811@corp.supernews.com...
> > > > > No, there is no way to allocate NonPagedPool at DISPATCH_LEVEL.
So
> the
> > > > next
> > > > > question is why do you need to allocate at dispatch?
> > > > >
> > > > >
> > > > > -- 
> > > > > Don Burn (MVP, Windows DDK)
> > > > > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > > > > Remove StopSpam from the email to reply
> > > > >
> > > > > "Sam Johnson" <Sam Johnson@discussions.microsoft.com> wrote in
> message
> > > > > news:8B1F14A8-69E8-4C87-8494-294C1626EFDC@microsoft.com...
> > > > > > Hello,
> > > > > >
> > > > > > I'm rather new to driver development and I've got a question:
> > > > > > In my driver I use the ExAllocatePoolWithTag function. As I'm
> running
> > > on
> > > > > > DISPATCH_LEVEL, I need to specifiy NonPagedPool as a pool type.
> But as
> > > > I'm
> > > > > > allocating rather a big amount of memory, I'd prefer a paged
pool
> > > > > allocation.
> > > > > > Is there any way to do this in DISPATCH_LEVEL?
> > > > > >
> > > > > > Thanks to everyone
> > > > > > Sam
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> > >
>
>

Relevant Pages

  • Re: race conditions
    ... in general any code that runs at elevated IRQL and somehow relies ... For information about which types of IRPs are used in paging I/O, ... Dispatch Routine IRQL and Thread Context. ... better with work items. ...
    (microsoft.public.development.device.drivers)
  • Re: DRIVER_VERIFIER_IOMANAGER_VIOLATION
    ... The IO manager has caught a misbehaving driver. ... Arg1: 00000005, Irql not equal across call to the driver dispatch routine Arg2: ffb96870, the device object associated with the offending driver Arg3: 00000000, the Irql before the call ... Argument 2 tells you the device object whose dispatch routien was called. ... Argument 3 tells you that the dispatch routine was called at passive level. ...
    (microsoft.public.development.device.drivers)
  • Re: DRIVER_VERIFIER_IOMANAGER_VIOLATION
    ... The IO manager has caught a misbehaving driver. ... Arg1: 00000005, Irql not equal across call to the driver dispatch routine Arg2: ffb96870, the device object associated with the offending driver Arg3: 00000000, the Irql before the call ... Argument 3 tells you that the dispatch routine was called at passive level. ... You received an IRP in your dispatch routine at IRQL PASSIVE_LEVEL and you raised IRQL to DISPATCH_LEVEL and forwarded the IRP on down the stack at DISPATCH_LEVEL rather than ...
    (microsoft.public.development.device.drivers)
  • Re: Synchnonization between 2 Dispatch level threads in Kernel
    ... I am not running at IRQL 25 but at priority 25. ... Acquire the Interrupt spin lock (use KeSynchronizeExecution if you ... Don Burn ...
    (microsoft.public.development.device.drivers)
  • Re: Verifier doesnt catch IRQL violation
    ... Too costly in terms of time to check IRQL or something? ... Don Burn (MVP, Windows DDK) ... Windows 2k/XP/2k3 Filesystem and Driver Consulting ...
    (microsoft.public.development.device.drivers)