Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting... Please check out the Community Guidelines in the
Announcements and Administration Category.

Should I always mark my functions as PAGED in mini-filter?

Question like in the title.

#pragma alloc_text(PAGE, FunctionName)

Should I always do this in mini-filter?

Comments

  • David_F.David_F. Posts: 161
    only if the function would be guaranteed to run PASSIVE_LEVEL


    https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/writing-preoperation-callback-routines

    "Like a dispatch routine, a preoperation callback routine can be called at IRQL = PASSIVE_LEVEL or at IRQL = APC_LEVEL. Typically it is called at IRQL = PASSIVE_LEVEL, in the context of the thread that originated the I/O request. For fast I/O and file system filter (FsFilter) operations, the preoperation callback routine is always called at IRQL = PASSIVE_LEVEL. However, for an IRP-based operation, a minifilter driver's preoperation callback routine can be called in the context of a system worker thread if a higher filter or minifilter driver pends the operation for processing by the worker thread."

    https://social.msdn.microsoft.com/Forums/en-US/acbdf5a7-f2db-45ff-a9ba-4a56a594cb50/minifitler-irql?forum=wdk

    "In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL."
  • Thank you for your answer David.

    Should I also mark functions PAGED when I call them inside functions with PASSIVE_LEVEL? For example I have function ReplaceCharacters that I use in preoperation. Should it be marked PAGED too?
  • James Danks wrote:
    >
    > Should I always mark my functions as PAGED in mini-filter?

    A function can be safely placed in the paged section only if
    ALL the following conditions are true:

    1. The function is never called at DISPATCH_LEVEL or higher.

    2. The function is not raises IRQL to DISPATCH_LEVEL or higher,
    directly or indirectly.

    3. The function is not involved in the page fault handling
    (i.e. is not called on paging I/O path).

    4. The function is not calls other functions that may
    violate the rules above.

    Also, some type of drivers (for example, storage drivers)
    must be in resident memory all of the time.

    ----

    In my opinion, the 'paged code' was designed for very limited and
    very specific cases. Today, it has no benefits except a little
    (microscopic!) economy of system resources when code is paged out.

    On other side, the paging of code may lead to phantom bugs that
    are really hard to diagnose. And most of time you will try to
    solve the big problem: "to page or not to page" :)
    Instead of doing your business...

    So, my answer is: you should not.
  • Don_BurnDon_Burn Posts: 1,623
    Actually even storage drivers may make some functions pageable, but these
    are things like support for WMI, and other non-operational (i.e. not
    directly involved with storage I/O) functions.


    Don Burn
    Windows Driver Consulting
    Website: http://www.windrvr.com



    -----Original Message-----
    From: xxxxx@lists.osr.com
    [mailto:xxxxx@lists.osr.com] On Behalf Of
    xxxxx@mail.ru
    Sent: Friday, December 29, 2017 4:24 PM
    To: Windows File Systems Devs Interest List <xxxxx@lists.osr.com>
    Subject: RE:[ntfsd] Should I always mark my functions as PAGED in
    mini-filter?

    James Danks wrote:
    >
    > Should I always mark my functions as PAGED in mini-filter?

    A function can be safely placed in the paged section only if ALL the
    following conditions are true:

    1. The function is never called at DISPATCH_LEVEL or higher.

    2. The function is not raises IRQL to DISPATCH_LEVEL or higher,
    directly or indirectly.

    3. The function is not involved in the page fault handling
    (i.e. is not called on paging I/O path).

    4. The function is not calls other functions that may
    violate the rules above.

    Also, some type of drivers (for example, storage drivers) must be in
    resident memory all of the time.

    ----

    In my opinion, the 'paged code' was designed for very limited and very
    specific cases. Today, it has no benefits except a little
    (microscopic!) economy of system resources when code is paged out.

    On other side, the paging of code may lead to phantom bugs that are really
    hard to diagnose. And most of time you will try to solve the big problem:
    "to page or not to page" :) Instead of doing your business...

    So, my answer is: you should not.


    ---
    NTFSD is sponsored by OSR


    MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
    drivers!
    Details at <http://www.osr.com/seminars>;

    To unsubscribe, visit the List Server section of OSR Online at
    <http://www.osronline.com/page.cfm?name=ListServer>;
  • David_F.David_F. Posts: 161
    Don, is your statement "In general assume the IRQL can be DISPATCH_LEVEL, except for PreCreate which is guaranteed to be PASSIVE_LEVEL" in regards to the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how assumptions go.

    Thanks.
  • Don_BurnDon_Burn Posts: 1,623
    Actually since the question was on storage drivers I was thinking below
    mini-filter level. I have written a number of disk filters that have some
    paged routines. I have also written storport drivers with some paged
    routines.


    Don Burn
    Windows Driver Consulting
    Website: http://www.windrvr.com




    -----Original Message-----
    From: xxxxx@lists.osr.com
    [mailto:xxxxx@lists.osr.com] On Behalf Of
    xxxxx@terabyteunlimited.com
    Sent: Saturday, December 30, 2017 8:34 PM
    To: Windows File Systems Devs Interest List <xxxxx@lists.osr.com>
    Subject: RE:[ntfsd] Should I always mark my functions as PAGED in
    mini-filter?

    Don, is your statement "In general assume the IRQL can be DISPATCH_LEVEL,
    except for PreCreate which is guaranteed to be PASSIVE_LEVEL" in regards to
    the PreOperation for IRP_MJ_CREATE ? I assume so, but you know how
    assumptions go.

    Thanks.


    ---
    NTFSD is sponsored by OSR


    MONTHLY seminars on crash dump analysis, WDF, Windows internals and software
    drivers!
    Details at <http://www.osr.com/seminars>;

    To unsubscribe, visit the List Server section of OSR Online at
    <http://www.osronline.com/page.cfm?name=ListServer>;
  • David_F.David_F. Posts: 161
    Well, is there a "cheat sheet" for all the various IRP's and which ones are guaranteed to be PASSIVE_LEVEL? IRP_MJ_CREATE PreOperation, IRP_MJ_SET_INFORMATION PreOperation, PostOperations ? It's easy to just say, forget it, everything is non-paged, but there must be some sort of standard? (I mean if some minifilter along they way elevates the irql outside of the "standard" it could cause problems down the line, but if it was well documented on the "standard" then they wouldn't elevate the irql). So I guess having to deal with that, it should just all be non-paged ?
  • David F. wrote:
    >
    > It's easy to just say, forget it, everything is non-paged, but there must
    > be some sort of standard?

    Yes:

    Dispatch Routine IRQL and Thread Context
    https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-irql-and-thread-context
  • OSR_Community_UserOSR_Community_User Posts: 110,218
    Thank you all for your answers and happy new year 2018 :)
  • David_F.David_F. Posts: 161
    https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/dispatch-routine-irql-and-thread-context

    Great!!

    Now if MS would put back their little yellow printer icon on their website... The web browsers nowadays don't do a very good job.
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!