Re: interrupt routine and application pages
- From: "Don Burn" <burn@xxxxxxxxxxxxxxxx>
- Date: Fri, 27 Oct 2006 15:35:37 -0400
You need to lock the pages in memory before the interrupt. You will be
taking physical pages so it the stack is huge it will impact perfromance of
the system.
--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply
"RJ" <RJ@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:437FFC23-257F-40AB-A0DC-EB51EFAEAE15@xxxxxxxxxxxxxxxx
Do you mean I can create MDL and lock the pages in the interrupt routine
if I
know the application stack pointer? Or Do I need to probe and lock the
stack
pages before the interrupt starts?
If you mean the first case, I already tried it out. When I call
MmUnlockPages() in interrupt, it corrrupts interrupt stack and windbg
reports
some exception. (I do not have exact error now)
If you mean the second case, I need to figure out where the application
stack will be once it is loaded into the memory. Also I need to lock the
pages as long as the application/interrupt runs. Is it going to affect
the
performance of system/application significantly?
Thanks,
RJ
"Don Burn" wrote:
Ok, this may be able to be done. You will need to know the range of
the
stack and create a MDL for the stack area, then proble and lock the
pages.
From thst you can get a non-paged system address, and use it to
reference
the stack. Now you still have the stack pointer problem, since the
stack
pointer in the ISR is the kernel stack pointer not the user stack
pointer.
If you can find the stack pointer you need to rationalize it to be
relative
to the system address you get.
--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply
"RJ" <RJ@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8B1BBE2A-74D4-40B7-99A5-989243D1CFD2@xxxxxxxxxxxxxxxx
Hi Don,
Thanks for the quick reply. I do have the right stack pointer and
PsGetCurrentProcessId() returns the PID for the process that was
running
when
the interrupt happened.
I need to access the stack only if the PID is of the process I am
interested
in.
So I know the PID of the interested application. This is to generate
the
Callstack of the application at the interrupt.
Thanks,
RJ
"Don Burn" wrote:
You cannot do this. The application code is pageable and an
interrupt
service routine runs at Device IRQL which cannot access pageable
code.
Also, you are running in arbitrary thread context, i.e you do not
know
what
the thread or the process will be, so what are you going to do with
the
stack (assuming you had a way to find the stack pointer?). You
cannot
walk
the stack since you do not know the calling conventions being used by
the
application, you cannot read a variable since you don't know what the
application is.
Tell us what you are really trying to accomplish, and maybe there is
an
approach.
--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply
"RJ" <RJ@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C60CC328-2272-45D7-9611-DC859F738C1F@xxxxxxxxxxxxxxxx
Hello,
I have a requirement to examine currently running application stack
on
an
interrupt routine. Is it safe to read application memory on an
interrupt
routine? What is IRQL at which page swapping happens? What is the
mechanism
that can be used to make sure that memory area is safe to read?
I would like to use "MmProbeAndLockPages", but it can be used only
<=
APC_LEVEL
Any hints appreciated.
Thanks,
RJ
.
- Follow-Ups:
- Re: interrupt routine and application pages
- From: soviet_bloke
- Re: interrupt routine and application pages
- References:
- Re: interrupt routine and application pages
- From: Don Burn
- Re: interrupt routine and application pages
- From: Don Burn
- Re: interrupt routine and application pages
- From: RJ
- Re: interrupt routine and application pages
- Prev by Date: Re: Driver installation in 64-bit machine
- Next by Date: Re: NDIS virtual miniport receive packet indication?
- Previous by thread: Re: interrupt routine and application pages
- Next by thread: Re: interrupt routine and application pages
- Index(es):
Relevant Pages
|